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FOREWORD 


This  is  the  second  of  three  reports  to  be  submitted  under  Contract  No. 
DAAA09-51-C-3006  being  conducted  by  IIT  Research  Institute,  Chicago,  Illinois, 
for  the  U.  S.  Army  ARRCOM,  Rock  Island,  Illinois.  This  report  describes  the 
results  of  a  hazards  analysis  of  the  Preparation  Building,  Accumulator, 

Mechanical  Removal  Building,  and  Large  Cells  (Priority  2)  at  the  Western  Area 
Demilitarization  Facility  (WADF)  at  Hawthorne,  Nevada.  A  hazards  analysis 
report  was  submitted  during  July  1982  for  the  Steam  and  Hydraulic  Systems  at 
WADF.  The  hazards  analysis  for  the  Priority  3  systems  (the  decontamination 
and  small  items  building,  the  flashing  chamber,  the  driverless  tractor  system 
and  the  off  loading  dock)  is  to  be  submitted  at  a  later  date.  The  Priority  2 
Report  is  submitted  in  two  volumes.  Volume  2  containing  fault  tree  diagrams 
for  the  systems  evaluated.  The  primary  IIT  Research  Institute  project  team 
consisted  of  Ronald  Pape,  Edmund  Swider,  Kim  Mniszewski,  Charles  Heilker,  Dwayne 
Eacret,  and  Cindy  Marrazzo.  Mr.  Thomas  Grady,  a  private  consultant  with  consider¬ 
able  experience  in  explosive  and  propellant  operations,  helped  scrutinize  the 
results  of  the  analysis.  Respectfully  submitted 
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1.  INTRODUCTION 


This  report  contains  the  results  of  a  hazards  analysis  of  the  Preparation 
Building,  Accumulator,  Mechanical  Removal  Building,  and  Large  Cells  at  the 
Western  Area  Demilitarization  Facility  (WADF)  at  Hawthorne,  Nevada.  The  method¬ 
ology  used  was  a  combination  of  failure  modes  and  effects  analysis  (FMEA)  and 
fault  tree  analysis  (FTA),  with  quantification  accomplished  through  the  use  of 
a  fault  tree  computer  model.  These  techniques  were  described  in  the  Priority  1 
report  and  are  repeated  here  in  Appendix  A. 

The  hazards  analysis  that  was  conducted  produced  two  types  of  results. 

First,  the  scenarios  that  can  lead  to  a  hazardous  outcome  were  identified  by 
constructing  fault  tree  logic  diagrams  for  each  plant  section.  Such  scenarios  are 
chains  of  events  or  combinations  of  events  that  must  occur  together  or  in  sequence 
to  cause  the  outcome  of  concern.  For  example,  for  an  operator  to  become  burned 
by  touching  a  hot  surface,  several  things  must  happen: 

lo  the  surface  must  be  sufficiently  hot  to  burn  someone,  and 
2.  an  operator  must  touch  the  hot  surface 

Both  of  these  events  are  necessary  in  order  for  the  operator  to  become  burned. 

The  combination  of  events  is  a  scenario.  To  evaluate  whether  such  a  scenario 
is  significant,  "probability  of  occurrence"  values  are  derived  for  each  event 
in  the  scenario,  thereby  making  it  possible  to  compute  the  overall  scenario 
probability  of  occurrence.  Scenario  probabilities  are  derived  in  terms  of 
probability  per  year,  or  expected  frequency  of  occurrence  averaged  over  an 
extremely  long  time  frame. 

All  the  scenarios  for  the  specific  plant  section  are  then  compared  based 
on  their  derived  probabilities  per  year.  Naturally,  those  scenarios  with  the 
highest  probability  values  are  most  critical  and  must  be  addressed  first. 

Section  2  of  this  report  summarizes  the  systems  at  the  Western  Area  Demili¬ 
tarization  Facility  that  have  been  evaluated  under  Priority  2,  Section  3  pre¬ 
sents  the  hazards  analysis  results  for  each  plant  area.  Section  4  provides 
recommendations  and  conclusions  based  on  the  results  of  this  analysis.  In 
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addition  to  a  discussion  of  the  hazards  analysis  methodology  in  Appendix  A, 
the  appendices  provide  more  detailed  information  on  the  preparation  building 
ether  vapor  problem  (Appendix  B),  initiation  probability  curves  constructed 
for  propellants  (Appendix  C),  transient  heat  transfer  models  used  for  the 
required  engineering  analyses  (Appendix  D),  and  a  model  to  estimate  the 
maximum  electrostatic  discharge  energy  for  a  dielectric  surface  (Appendix  E). 
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2.  PRIORITY  2  SYSTEMS 


The  systems  at  WADF  evaluated  for  potential  hazards  under  Priority  2 
include  the  Preparation  Building,  Accumulator  System,  Mechanical  Removal 
Building  and  Large  Cells.  These  systems  are  described  briefly  in  this  section. 

2ol  PREPARATION  BUILDING  AND  ACCUMULATOR 

Mechanical  disassembly  of  items  is  to  be  performed  in  the  Preparation 
Building  in  individual  cell  areas  of  the  building.  Processes  include  (1)  pull 
apart  of  elements  joined  by  crimping  (e.g.,  removing  the  projectile  from  the 
cartridge  case);  (2)  unscrewing  the  parts  such  as  fuzes  from  projectiles, 
rocket  motors  from  warheads,  or  fuzes  and  fin  assemblies  from  mortar  cartridges; 
(3)  removal  of  propellant  from  cartridges; and  (4)  removal  of  primers  from  cart¬ 
ridge  cases.  The  Preparation  Building  cells  are  to  handle  gun  type  ammunition 
up  to  and  including  6  inch.  There  are  six  work  cells  in  the  building.  Each 
cell  has  4  UV  detectors  and  a  preprimed  (wet)  water  deluge  system.  Operations 
are  monitored  by  closed  circuit  TV.  Currently  cells  1  and  2  are  not  equipped. 

Cell  Sis  currently  for  breakdown  of  60  mm  and  81  mm  mortar  cartridges.  Two 
rounds  at  a  time  are  placed  on  a  holding  fixture  (steel  plate  shuttle)  in 
front  of  the  cell  by  an  operator.  At  the  proper  time,  the  holding  fixture  is 
indexed  into  the  cell  through  an  access  porto  Once  inside  the  cell,  under  the 
watchful  eyes  of  the  control  operator,  the  previously  disassembled  two  rounds 
are  picked  up  by  the  robot  (manipulator)  at  the  disassembly  "lathe"  and  placed 
in  the  holding  fixture.  Next  the  robot  picks  up  the  complete  rounds  and  brings 
them  into  clamping  position  at  the  "lathe".  With  the  rounds  held  firmly,  the 
chucks  on  either  side  of  the  cartridge  unscrew  the  fuze  on  one  end  and  the  tail 
fin  on  the  other  end.  The  head  and  tail  units  are  then  automatically  picked  up 
and  dropped  into  water  filled  containers  sitting  next  to  the  machine.  The 
mortar  body  is  carried  by  the  manipulator  to  the  shuttle  conveyor  to  the  corri¬ 
dor  outside  the  cell. 

Cells  4,  5,  and  6  are  dedicated  to  disassembly  of  gun  ammunition.  A  con¬ 
veyor  from  the  corridor  carries  projectiles  and  cartridge  cases  into  Cell  5. 
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In  Cell  5,  a  pull  apart  machine  removes  the  projectile  from  the  cartridge  case 
on  fixed  munitiono  For  plugged  cartridge  cases,  when  the  shell  and  case  are 
separate  (separate  gun  ammunition)  the  pull  apart  machine  is  replaced  by  an 
end  cut  off  machine  which  removes  the  end  of  the  case  by  using  a  tube  cutter 
type  deviceo  In  that  case,  the  projectile  enters  Cell  5  separately  and  goes 
directly  to  Cell  6.  In  Cell  6,  an  unscrewing  machine,  just  like  that  in  Cell  3, 
is  used  to  remove  fuzes  and  base  fuzes. 

The  cartridge  cases  are  moved  by  the  robot  from  the  tube  cutting  device 
into  a  horizontal  position  for  the  removal  of  a  wad  prior  to  dumping  of  the 
propel  1  ante  The  propellant  is  dumped  from  the  cases  onto  a  conductive  rubber 
belt  conveyor  to  be  carried  to  the  accumulator  building.  Then  the  cartridge 
case  is  shuttled  into  Cell  4  via  a  conveyor.  In  Cell  4,  the  cartridge  case  is 
automatically  placed  into  a  fixture  to  punch  out  the  primer  in  its  base. 

When  the  cartridge  case  is  conveyed  back  into  the  corridor,  the  operator  must 
manually  remove  the  primer  from  the  inside  of  the  case. 

As  mentioned  above,  the  propellant  removed  from  the  cartridge  cases  is 
conveyed  to  the  Accumulator  Building.  The  conveyor  is  enclosed  and  protected 
with  UV  sensors,  and  deluge  nozzles  every  six  feet.  At  the  accumulator,  the 
receiving  storage  hopper  is  equipped  with  two  high-level  sensors,  the  lower 
one  to  stop  operations  in  Cell  5  of  the  preparation  building  and  the  upper  one 
to  stop  the  conveyor  motion.  The  material  is  routed  from  the  storage  hopper 
to  a  vibratory  feeder  conveyor  and  finally  to  a  weigh  hopper.  The  propellant 
is  then  metered  into  type  III  or  MK  IV  containers  for  storage  or  sale.  Two 
bag  collector  units  service  the  preparation  and  accumulator  buildings.  In 
addition,  a  vacuum  system  is  available  for  special  cleanup  operations.  Four 
vacuum  cleaning  units  each  consist  of  a  cyclone  separator,  wet  collector  and 
dry  collector.  These  are  housed  in  the  cells  immediately  adjacent  to  the 
central  propellant  packaging  cell.  The  outermost  cells  hold  the  pumps  used 
to  pull  the  air  through  the  vacuum  collection  units. 

2.2  MECHANICAL  REMOVAL  BUILDING 

The  mechanical  removal  building  contains  equipment  used  to  expose  the 
interior  of  conventional  munition  items  and  to  provide  access  for  explo¬ 
sive  removal  processes.  Also,  in  some  cases  on  large  munitions,  the  facility 
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is  used  to  provide  vent/view  holes  in  the  item  to  facilitate  inspection  of 
the  items  prior  to  flashing  them  of  residual  materials  in  the  flashing  chambero 
The  operations  include  trepanning  (hole  cutting),  sawing,  shearing  and 
punching  of  holes  in  munition  items.  Before  entering  the  mechanical  removal 
building,  some  items  are  washed/steamed  out  leaving  only  small  amounts 
(under  ten  pounds)  of  explosive  in  them,  with  acceptance  determined  by 
visual  inspection,  while  other  items  are  fully  loaded. 

Forklifts  are  used  to  move  items  from  the  conveying  vehicle  (driverless 
tractor  and  carts)  into  the  building  where  jib  cranes  are  employed  at  the 
corridor-to-cell  port  of  each  cell.  On  all  large  or  heavy  items  jib  cranes 
are  used  to  place  items  onto  carriages/tooling  which  convey  the  items  into 
cells  for  processing  on"through-port"  conveyors. 

All  operations  in  the  cells  are  controlled  remotely  by  operators  in  the 
control  room  of  the  building.  Cell  1  houses  equipment  used  for  punching  holes 
in,  or  shearing,  relatively  small  munition  items  (such  as  MKl  boosters  or  MK42 
primers)  containing  appreciable  amounts  of  energetic  material.  Ammunition 
items  are  mounted  on  tooling  carrier  plates  that  ride  on  a  conveyor.  Clamping 
elements  hold  the  tooling  carriers  in  a  predetermined  position  in  the  press 
accurately  and  positively  for  shearing  and/or  punching.  Presently  primers 
longer  than  8  inches  are  to  be  sheared  into  smaller  pieces  using  an  industrial- 
type  hydraulically  operated  press. 

Cell  2  contains  a  band  saw  for  sawing  items  25  inches  in  diameter  or  less. 
Presently  the  MK  4  depth  charge  noses  are  to  be  sawed  off  by  the  band  saw  to 
expose  the  explosive  charge  for  easier  removal.  The  items  are  clamped  to  a 
tooling  carrier  which  rides  on  a  conveyor  between  the  band  saw  and  the 
corridor.  A  pov;ered-rol ler  conveyor  is  used  together  with  a  ball  transfer 
table  to  manipulate  the  tooling  carriers.  Holding  clamps  fix  the  tooling 
carrier  accurately  and  positively  in  a  predetermined  position  while  sawing  is 
underway. 

Cell  3  holds  trepanning  (hole  sawing)  equipment  to  cut  a  series  of  5  inch 
diameter  vent/view  holes  simultaneously  in  large  munition  items.  A  special 
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hole  cutting  machine,  equipped  with  a  shuttling  carnage,  a  deep  bed  filter  and 
an  aspirator  is  applied  in  Cell  3  to  produce  the  vent/view  holes.  The 
shuttling  carriage  rides  on  two-section  ways,  one  section  inside  the  cell  and 
the  second  section  in  the  corridor.  The  hole  cutting  machine  consists  of  a 
framework  on  which  six  horizontally  oriented,  hydraulically  powered  spindle 
heads  are  mounted  in  parallel.  A  hydraulic  cylinder  on  each  head  provides  the 
stroke.  A  "slug"  ejection  device  is  provided  on  each  head  to  push  the  cut-out 
portion  of  the  items  out  of  the  hole  saw  and  into  the  item  being  processed. 

In  conjunction  with  the  heads  are  six  horizontally  oriented,  hydraulically 
actuated  backstop  units  provided.  The  purpose  of  the  backstop  units  is  to 
resist  the  force  applied  by  the  heads  during  the  cutting  operation. 

An  aspirator  is  included  as  part  of  the  hole  cutting  equipment  to  remove 
the  coolant  accumulated  in  the  interior  of  the  item  during  hole  sawing.  Coolant 
is  removed  from  the  item  when  it  is  returned  to  the  corridor.  In  special  cases 
should  additional  vent  area  be  required  or  should  view  openings  in  other  places 
be  required,  after  the  first  array  of  holes  are  cut  and  the  item  retracted  to 
the  corridor,  the  clamps  holding  the  item  can  be  released,  the  item  rotated  on 
the  carriage,  reclamped,  and  reintroduced  to  the  cell  for  the  cutting  of  another 
set  of  holes  in  a  second  plane. 

At  the  time  of  the  hazards  analysis  the  major  cells  were  operational 
and  equipped  with  the  appropriate  machines,  conveyors,  tooling/fixtures,  and 
jib  cranes  or  assist  devices.  Two  smaller  cells  and  an  extra  room  are  located 
in  the  Mechanical  Removal  Building  on  the  same  side  of  the  corridor  as  the 
operational  cells.  Across  the  corridor  from  the  cells  is  the  mechanical  room 
housing  all  equipment  and  utilities  necessary  for  the  operation  of  the  building. 

Also,  the  control  room  is  located  across  from  the  cells,  housing  the  controls 
necessary  to  remotely  operate  the  equipment  in  the  cells  together  with-CCTVs* 
to  observe  the  operation  in  each  cell. 

2.3  LARGE  CELLS 

Three  large  cells  (constructed  with  frangible  walls  and  ceilings  due  to  the 
hazardous  operations  performed  on  large  munitions)  are  located  adjacent  to  the 
mechanical  removal  building.  These  house  machines  used  in  disassembly  operations  for 
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large  munitions  items.  Two  of  these  cells  are  currently  in  use.  Cell  B  is 
set  up  for  cutting  open  MK  16  mines  using  a  band  saw.  Cell  C  contains  an 
unscrew  machine  for  defuzing  major  caliber  munition  items.  Cell  A  is  presently 
empty  and  could  be  used  for  temporary  storage  (within  allowable  charge  weight 
envelopes)  of  large  munition  items.  These  cells  are  serviced  by  an  over-head 
bridge  crane  system  to  move  the  large  munition  items  in  and  out  of  the  cells. 
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3.  SUMMARY  OF  HAZARDS  ANALYSIS  RESULTS 


3.1  PREPARATION  BUILDING 

Results  of  the  fault  tree  analysis  of  the  Preparation  Building  operations 
indicate  a  category  I  or  II  accident  frequency  of  0.402  per  year,  excluding 
injuries  and  illnesses  of  various  causes.  Of  these  0.402  incidents  per  year. 
0.327  per  year  were  equipment  damage  mainly  due  to  machinery  impacts  and  robot^ 
malfunctions.  Explosive  and  propellant  fires  made  up  the  remaining  7.51  x  10 

incidents  per  year. 

The  accident  frequencies  are  further  categorized  in  Table  1,  for  the 
seven  areas  in  the  preparation  building  where  explosive  items  are  handled, 
including: 

•  Offloading  Areas 

•  Cell  1  (unsafe  item  storage) 

•  Cell  3  (mortar  shell  disassembly) 

•  Cell  4  (deprimer  operations) 

t  Cell  5  (pull-apart,  case  cutter,  case  dumpers  and  item 
transfer  operations) 

In  order  to  quantify  the  fault  tree  analysis,  scheduling  data  was  required. 
Since  long  term  production  rates  for  each  area  and  for  each  type  of  projectile 
are  not  firm  at  this  time,  estimates*  had  to  be  used.  The  values  that  were  used 
are  summarized  below: 

•  nominal  production  rates  are  89/hr  for  the  Cell  3  operations 
(mortar  shell  breakdown)  as  well  as  the  Cell  4-5-6  operation 
(gun  ammunition  breakdown) 

t  both  of  these  operations  are  assumed  to  be  run  simultaneously 

•  operations  will  take  place  during  two  shifts  per  day  (16  hours) 

•  For  Cell  5  pull-apart  and  case  cutter  operations,  the  processing 
rates  are  weighted  by  the  amount  of  different  item  categories 
requiring  these  facilities  (i.e.  18  items  per  hour  in  the  pull- 
apart  operation  and  71  items  per  hour  in  the  case  cutter). 

The  most  serious  incidents  considered  are  those  involving  explosion  and 
fire  because  of  the  high  potential  human  and  property  losses.  The  fault  tree 

*These  estimates  are  based  on  considerable  analyses  presented  in  reference  2. 
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Table  1  Estimated  Accident  Frequencies  in  Preparation 
Building  Areas  (per  year) 


Area 


Frequency  of  Category 
I  or  II  Accident 


Frequency  of  Frequency  of  Other 
Explosion/Fire  Major  Equipment  Damage 


Offloading  Area 

8.88 

Cell  1 

6.19 

Cell  3 

6,55 

Cell  4 

9.14 

Cell  5 

9.01 

Cell  6 

8.99 

X  10“^  8«49  X 
X  10“®  H  6.19  X 
X  10"^  e?'  2,32  X 
X  10“^  lo65  X 
X  10"^  N.  1.59  X 
X  10"^  &f;  2.59  X 


1 

o 

3.90 

X 

O 

1 

cn 

10-^ 

10"^ 

4,23 

X 

10"^ 

10"^ 

8.97 

X 

10"^ 

10“^ 

7.42 

X 

10"^ 

10"^ 

6.40 

X 

10"^ 

TOTAL  0.402 


7.51  X  10“^ 


..  I  " 

r 

..jr  t  ; 


0.327 
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analysis  has  shown  the  most  probable  scenarios  are  those  involving  manual  item 
handling  operations,  fuze  drop-tank  problems,  manipulator  malfunctions,  pull- 
apart/case-cutter  ether  problems,  station/station  transfer  machine  problems, 
external  contamination  problems,  driverless  tractor  operations,  and  particular 
ESD  problems.  The  most  significant  of  these  are  described  below  for  each  cell 
in  the  preparation  building 

3.1.1  Offloading  Area 

The  offloading  area  is  the  receiving  area  for  the  Preparation  Building. 

The  expected  accident  frequency  in  this  area  is  less  than  that  estimated  in 
the  distribution  area  where  much  more  manual  handling  of  single  items  is  done. 
Accident  scenarios  with  the  highest  frequency  of  occurrence  in  the  offloading 

area  resulted  from  the  following'  ^ 

•  Driverless  tractor  impacts  a  v/all  or  fixed  object  (8o47  X  10  /year) 

•  Impact  initiation  during  maintenance  in  which  heavy  equipment  is 
moved,  (3.9  X  10  ^/year) 

Driverless  Tractor  Impacts  a  Wall  or  Fixed  Object  (8.47  X  10  /year)  o 

In  this  scenario,  a  driverless  tractor  cart  load  impacts  a  wall  or  fixed 
object  while  the  items  to  be  processed  are  brought  into  the  preparation  building. 

This  scenario  is  summarized  in  the  table  below. 

Fault  Tree  Probability/ 

Component  No.*  Description  Frequency  Used 


24 

driverless  tractor  load  arrives 
at  off-loading  area 

1.85/hr 

25 

during  transfer  operation,  operator 
backs  cart  into  wall  or  fixed 
object  (human  error  probability) 

0.01 

26 

Impact  is  sufficient  to  cause 
initiation  of  items** 

1.1  X  10' 

*  Component  numbers  correspond  to  the  fault  tree  numbering  that  appears  in 
Volume  2. 

**  The  value  of  1.1  X  10“^  for  rough  handling  of  full  munitions  items  is 
discussed  in  the  Priority  1  report. 
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Impact  Initiation  During  Maintenance  in  Which  Heavy  Equipment  is  Moved 

(3.9  X  10~^/year)  i  ^  ' 

In  this  category  of  scenarios,  maintenance  is  required  in  the  offloading 
area  in  which  heavy  equipment  must  be  moved.  Due  to  a  human  error  the  equip¬ 
ment  being  moved  experiences  an  impact  causing  major  damage. 


This  scenario 

is  summarized  below. 

Fault  Tree 
Component  No. 

Description 

Probability/ 
Frequency  Used 

74 

Heavy  equipment  is  moved  during 
maintenance 

3.125  X  10"^/hr 

75 

Operator  error  during  transfer 
causes  impact 

0.003 

77 

Impact  is  sufficient  for  major 
equipment  damage 

0.001* 

*  Based  on  engineering  judgement 

3.1.2  Cell  1 

Cell  1  in  the  preparation  building  is  to  be  used  for  intermediate  storage 
of  "unsafe"  items.  The  items  are  stored  until  enough  of  them  accumulate  to  be 
taken  away  to  the  disposal  area.  "Unsafe"  items  here  are  any  items  which  appear 
to  be  unfit  for  processing  or  those  which  do  not  make  it  through  complete  pro¬ 
cessing  (eog.  jammed  items).  It  is  judged  that  one  out  of  every  thousand  items 
may  be  categorized  as  unsafe,  from  discussions  with  ARRCOM  personnel. 

Accident  scenarios  with  the  highest  frequency  of  occurrence  here  include: 

•  Item/Package  Dropped  by  Operator  During  Transfer  Causing 
Initiation  (IdD  X  10  /year) 

•  Explosive  Contamination  is  Initiated  by  a  Dropped  Tool  or  Other 
Item  (5.0  X  10“®/year) 
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Item/Package  Dropped  By  Operator  During  Transfer  Causing  Initiatiojx 

(1.19  X  10"®/year)  of- 

/' 

While  transferring  "unsafe"  items  to  or  from  Cell  1 ,  an  operator  error 
could  result  in  an  item  or  package  of  items  being  dropped.  There  is  a 
probability  that  such  a  drop  will  result  in  initiation  of  an  item.  This  is 
particularly  hazardous  since  the  operator  is  present  and  could  be  seriously 

injured. 

This  scenario  is  summarized  below. 


Fault  Tree 
Component  MOo 


43 

2 


Probabi 1 i ty/ 

Description  Frequency  Used 


Item  or  package  dropped  by 
operator  during  transfer  operation 

Drop  impact  is  sufficient  for 
ini tiation** 


2.6  X  10"^/hr 
1.1  X  10“^ 


Frequency  of  transfer  operations  times  the  probability  of  a  human  error 
resulting  In  the  Item  or  package  being  dropped 

Items  Impact  probability  ualue  discussed  In  the  Priority  1  report. 


Fxninsive  Contamination  Is  Initiated  by  a  Dropped  Tool  or  Other  Item. 

(5.0  X  10~^/year) 


with  poor  housekeeping,  explosive  contamination  could  accumulate  In  the 
area.  If  a  tool  or  other  object  Is  dropped  onto  such  a  thin  layer  of  explosive, 
an  Initiation  could  occur.  The  operator  dropping  the  tool  or  other  object 
could  be  seriously  Injured  If  the  contamination  layer  flashes.  If  the  "unsafe 
explosive  Items  are  Initiated, Cell  1  could  sustain  significant  damage. 

This  scenario  is  summarized  below. 
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Fault  Tree 
Component  No. 


Description 


Probability/ 
Frequency  Used 


Area  is  not  cleaned  frequently 
enough  (human  error) 

Explosive  particles  collect  on 
surfaces  (this  will  happen  if 
component  9  occurs) 

Significant  layers  build  up  over 
time 

Tool  or  item  drops  on  layer; 
initiation  occurs* 

Deluge  system  activated  too  late 
to  prevent  propagation 

Propagation  to  unsafe  explosives** 


0.001 

loO 

0.5 

2.4  X  10“Vhr 
0.02 
0.5 


*  Frequency  of  large  tool  drops  times  probability  of  initiation 
**  Engineering  estimate 


3.1.3  Cell  2 

No  activities  are  currently  planned  for  Cell  2,  therefore,  a  hazards 
analysis  was  not  required  for  this  area. 

3.1.4  Cell  3 

Cell  3  is  the  mortar  shell  disassembly  operation.  As  indicated  in  Table  1 
Cell  3  has  a  fairly  high  estimated  frequency  of  an  explosion  occurring  (i.e. 
2.83  X  10"^/year).  This  high  frequency  of  explosion  accidents  is  mainly  due  to 

the  scenarios  listed  below: 

t  Impact  Initiation  Resulting  from  the  Water  Filled  Fuze  Drop 
Tank  Being  Overfilled  with  Fuzes  or  Not  Filled  with  Water 

(2.2  X  10“^/year) 

t  Fuze  Safety  Wire  Pulled  Out  by  Cell  3  Machinery  Prior  to 
Drop  into  Fuze  Drop  Tank  which  has  too  many  Fuzes  or  Too 

Little  Water  (4.63  X  10”^/year) 

•  Impact  Due  to  Mechanical  Failure  of  Manipulator  Gripper 

(4.1  X  10"^/year)  _4 

t  Operator  drops  item  while  loading/unloading  (4.07X10  /year) 
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Separate  scenarios  were  also  identified  which  do  not  involve  explosion,  but 
can  result  in  significant  equipment  damage  anyway. 

•  jib  crane  operator  human  error  during  maintenance  causes 

equipment  damage  (1.56  X  10  ^/year)  i-.  ■■ 

•  manipulator  mechanical  failure  during  transfer  operations 

causes  major  impact;  equipment  damaged  (3.70  X  10  /year)  - 

A  better  estimate  of  accidents  due  to  manipulator  failures  can  be  made  if 
better  failure  rate  data  can  be  found  for  this  equipment.  Generic  failure 
rate  data  has  been  used  in  the  above  estimates. 

Impact  Initiation  Resulting  from  the  Water  Filled  Fuze  Drop  Tank  Being  ^ 
Overfilled  with  Fuzes  or  Not  Filled  with  Water  (2.2  X  10  /year)' 

The  water  filled  fuze  drop  tanks  are  required  in  the  system  to  cushion 
the  impacts  when  fuzes  are  collected  in  the  Cell  3  disassembly  operation.  If 
the  tank  is  not  filled  with  water  or  if  the  tank  is  allowed  to  become  over- 
filled  with  fuzes,  the  water's  protective  cushion  would  be  eliminated  and 
impact  initiation  of  the  fuzes  would  become  possible. 


A  typical  scenario 

in  this  category  is  summarized 

below: 

Faul  t  Tree 
Component  No. 

Description 

Probabi 1 i ty/ 
Frequency  Used 

141 

Fuze  released  from  fingers 

178/hr 

145 

Water  tank  overfilled  with 
fuzes  (human  error) 

.001 

142 

Fuze  impacts 

1.0 

143 

Impact  is  sufficient  for 
initiation* 

1.1  X  10  ^ 

144 

Explosion  propagates  to  other 
fuzes** 

0.5 

*  Item  impact  probability  discussed  in  Priority  1  report 

**  Engineering  estimate 

Fuze  Safety  Wire  Pulled  Out  Bv  Cell  3  Machinery  Prior  to  Drop  Into^Fuz^e 
Drop  Tank  Which  Has  Too  Many  Fuzes  or  Too  Little  Water  ,(4.63  X_10 — /year)_ 

The  previous  scenario,  in  which  the  fuze  drop  tank  is  allowed  to  become 
overfilled  with  fuzes  or  not  filled  with  water,  will  be  more  severe  if 
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the  fuze  safety  wire  is  pulled  out  during  the  unscrewing  operation.  The  wire 
could  be  pulled  out  if  the  head  chuck  is  out  of  adjustment  and  extends  out 
over  the  wire.  A  typical  scenario  in  this  category  is  summarized  below. 


Fault  Tree 
Component  No. 

Description 

Probability/ 
Frequency  Used 

145 

Water  tank  overfilled  with 
fuzes  (human  error) 

0.001 

270 

Item  is  processed 

89/hr 

271 

Fuze  is  released  by  fingers 

1.0 

272 

Fuze  impacts 

0.5 

273 

Sufficient  impact  for  initiation 
(estimate  without  safety  wire) 

0.5 

274 

Propagation  to  other  fuzes 
(engineering  estimate) 

0.5 

r* 

275 

Head  chuck  extends  to  wrong 
position  over  safety  wire 
(out  of  adjustment) 

1  X  10"^ 

276 

Head  chuck  is  clamped 

1.0 

Impact  Due  to  Mechanical 


Failure  of  Manipulator  Gripper 


(4.1  X  lO'Vyear) 


If  a  manipulator  in  Cell  3  fails  mechanically  it  could  cause  an  item  to 
sustain  an  impact  during  transfer.  Such  an  impact  could  result  in  the  initia¬ 
tion  of  the  item.  This  scenario  is  outlined  in  the  following  table: 


Fault  Tree  Probability/ 

Component  No.  Description  Frequency  Used 


77 

78 

79 


Item  being  handled  by  manipulator 

Mechanical  failure  occurs,  causing 
impact  of  item  against  equipment 

Impact  sufficient  for  initiation* 


89/hr 
1  X  10’^ 

1.1  X  10”^ 


*  Impact  initiation  probability  discussed  in  Priority  1  report 
Operator  Drops  Items  While  Loading/Unloading  (4.07  X  10  ^/year) 

The  items  processed  in  Cell  3  must  be  manually  loaded  onto  the  shuttle 
conveyor  leading  into  the  cell.  This  provides  the  opportunity  for  the  operator 
loading  the  items  to  drop  one: 
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Fault  Tree 
Component  No. 

30 

6 


Probability/ 

Description  Frequency  Used 

-3 

Operator  drops  item  during  8.9  X  10  /hr 

loading/unloading  operation  ^ 

Drop  is  sufficient  for  initiation*  1.1  X  10 


*  Item  initiation  probability  discussed  in  Priority  1  report 

Mechanical  Damage  Scenarios  Mot  Involving  Explosion  (4.23  x  10  /year) 

The  three  major  categories  of  non-explosion  scenarios  resulting  in  signi 
ficant  equipment  damage  are  summarized  on  the  tables  given  below: 

-2 

Equipment  Damage  Due  to  Manipulator  Mechanical  Failure  (3.702  X  10  /year) 


Fault  Tree 
Component  No. 

77 

Description 

Item  being  handled 

Probability/ 
Erequency  Used 

1  =  89/hr 

A 

78 

Manipulator  mechanical  failure, 
causing  impact  of  item  against 
equipment 

1  X  10 

80 

Impact  sufficient  for  equipment  0.001 

damage  (based  on  engineering  judgement) 

Equipment  Damage 

Due  to  Jib  Crane  Operator  Error  {l.._45 

X  10"^/year) 

Fault  Tree 
Component  No. 

Description 

Probability/ 
Frequency  Used 

Q 

216 

Jib  crane  used  during  maintenance 

1.25  X  10"Vhr 

217 

Heavy  items  lifted 

1.0 

221 

Operator  control  failure  causes 
item  drop  (human  error) 

0o003 

218 

Equipment  damaged  (engineering 
estimate) 

0.1 

IIT  RESEARCH  INSTITUTE 


16 


-3 

Equipment  Damage  due  to  Manipulator  Computer/Electronic  Failure  ( 3,702  X  10 _ ^ 

Fault  Tree  Probability/ 

Component  No.  Description  Frequency  Used 


67 

Item  being  handled 

89 

68 

Mani pul ator  computer/ el ectroni cs 
failure,  causing  impact  of  items 
against  equipment 

1  X  10 

70 

Impact  is  sufficient  for  equipment 
damage  (engineering  estimate) 

OoOOl 

3.1.5  Cell  4 

Cell  4  is  the  depriming  operation  where  primer  tubes  are  punched  out  of 
empty  cartridge  cases.  The  estimated  freguency  of  fire/explosion  accidents 
are  mainly  due  to  the  following  scenarios: 

•  operator  wearing  improper  clothing  in  the  area  causes  ESD  discharge 
initiating  an  open  item  during  troubleshooting  operation 

(7  X  10"^/year) 

•  manipulator  gripper/mechanical  failure  causes  an  item  to 
drop  (1.63  X  lO’^/year) 

•  manipulator  computer/electronic  failure  causes  an  item  to 
drop  (1.63  X  10“^/year) 

Significant  equipment  damage  scenarios  not  involving  fire  or  explosion 
incl ude: 

•  manipulator  computer/electronics  failure  causes  equipment 
damage  (3.7  X  10~^/year) 

•  manipulator  mechanical  failure  causes  equipment  damage 
(3„7  X  10"^/year) 

•  jib  crane  impact  due  to  human  error  during  maintenance 
causes  equipment  damage  (1.56  X  10  /year) 

Similar  scenarios  to  most  of  these  have  already  been  described  for  other 
locations  in  the  preparation  building.  The  scenario  involving  electrostatic 
discharge  from  an  operator  wearing  improper  clothing  is  new  and  is  delineated 
below: 
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Electrostatic  Discharge  from  Operator  During  Troubleshooting  in  Cell  4 

(7  X  IQ-^year) 


Fault  Tree 
Component  No, 


Description 


Probability/ 
Frequency  Used 


16 

Item  passed 

1.0 

49 

Troubleshooting  in  cell  is 
required,  with  open  items  present 

0.03/hr 

50 

Wears  ungrounded  shoes 

0.001 

51 

Supervisor  doesn't  stop  him 

0.5 

52 

Other  personnel  don't  stop  him 

0.7 

53 

Operator  becomes  charged  (dry  days) 

0.8 

54 

Operator  discharges  to  open  item/ 
layer 

1.0 

55 

Discharge  is  at  exposed  explosive 
(engineering  estimate) 

0.01 

56 

ESD  sufficient  to  cause  initiation 

0.02 

3.1„6  Cell  5 

Cell  5  is  the  gun  ammunition  transfer  center  to  cells  4  and  6,  and  also 
houses  the  case  dumper,  pull-apart,  and  case  cutter  operations.  The  estimated 
frequency  of  fire/explosion  accidents  here  are  mainly  due  to  the  following 
scenarios : 

•  operator  error  involving  mechanical  assist  operations  causes  item 
to  drop  (1.22  X  10"^/year) 

•  ether  vapor  ignition  during  case  cutter  operations 
(2.95  X  10“^/year) 

•  explosive  contamination  collects  in  mechanical  assist 
machinery  resulting  in  impact  initiation  (4.33  X  10  /year) 

•  ether  vapor  ignition  during  pull-apart  operations 
(7.40  X  10“^/year) 
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other  equipment  damage  scenarios  include: 

•  equipment  damage  due  to  impact  caused  by  manipulator  computer/ 

electronics  failure  (3.70  X  10  ^/year) 

•  equipment  damage  due  to  impact  caused  by  manipulator  mechanical 

failure  (3.70  X  10  ^/year) 

t  equipment  damage  involving  heavy  equipment  operations  during  ^ 

maintenance  by  operator  control  failure  of  jib  crane  (lo56  X  10  /year) 

Better  information  is  needed  on  the  possibilities  of  ether  vapor  evolving 
from  cases  to  better  assess  the  associated  fire/explosion  problem.  This  ether 
vapor  hazard  is  discussed  further  in  Appendix  B. 

The  ether  vapor  initiation  scenario  is  delineated  in  the  table  below 
for  the  case  cutter  operation: 

Ether  Vapor  Initiation  During  Case  Cutter  Operation  (2.95  X  10  /year) 

Fault  Tree  Probability/ 

Component  No.  Description  Frequency  Used 


456 

Items  processed  (case  cutter) 

71/hr 

457 

Significant  ether  is  released 
during  operation 

1.0 

459 

Ether  ignition  by  mechanical  spark 

1  X  10' 

458 

Propagation  to  other  flammable 
items  (propellant) 

0.5 

438 

Deluge  system  activation  too  late  to 
prevent  propagation 

0.02 

3.1.7  Cell  6 

Cell  6  is  the  projectile  defuzing  operation.  The  estimated  frequency  of 
fire  or  explosion  accidents  here  is  mainly  due  to  the  following  scenarios: 

•  impact  initiation  from  fuze  finger  failure  (6.51  X  10  /year) 
t  fuze  drop  water  tank  problem,  particularly  tank  overfilled 

(with  fuzes)  or  no  water  in  tank  (4.57  X  10  /year) 

•  station-to-station  transfer  equipment  causes  impact  of  item 

against  equipment  due  to  computer/electronics  failure  (3.26  X  10  /year) 
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t  explosive  contamination  collects  on  equipment  surfaces  and  initiation 
occurs  by  defuzer  mechanical  impact,  pinch/f^'iction  in  cell  port  door, 
impact  of  cell  port  door,  friction  in  conveyor  bearings,  pinch/ 
friction  in  cell  door,  etc.;  (lo64  X  10  ^/year) 

t  station  to  station  transfer  equipment  causes  drop  of  item  due 

-3 

to  computer/electfonics  failure  (1.63  X  10  /year) 

Other  equipment  damage  scenarios  include: 

•  damage  due  to  impact  of  station-to-station  transfer  machine 
caused  by  computer/electronics  failure  (3. 71  X  10  /year) 

•  damage  due  to  impact  of  station-to-station  transfer  machine 
caused  by  mechanical  failure  (3o71  X  10  ^/year) 

•  damage  due  to  jib  crane  operator  control  failure  in  moving 
heavy  equipment  during  maintenance  (1.56  X  10  /year) 

Similar  scenarios  to  most  of  these  have  already  been  described  for  other 
locations  in  the  preparation  building,  particularly  in  the  Cell  3  defuzing 
area.  A  station-to-station  transfer  equipment  impact  scenario  is  delineated 
in  the  following  table., 

Fault  Tree  Probability/ 

Component  NOo  Description  Frequency  Used 


44 

Item  being  handled  by  sta/sta 

89/hr 

transfer  machine 

A 

45 

Computer/electronics  failure, 
causing  impact  of  item  against 

8  X  1 0"^ 

equipment 

46 

Impact  sufficient  for  initiation* 

1.1  X  10 

*  This  initiation  probability  is  discussed  in  the  Priority  1  report 
3ol.8  Distribution  Area 

The  distribution  area  serves  as  a  shipping-out  point,  as  well  as  an  item 
packing,  cleaning,  vacuuming  area  for  processed  items.  The  estimated  frequency 
of  fire/explosion  accidents  here  is  mainly  due  to  the  following  scenarios: 
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-2 

t  operator  error  in  Cell  6  outlet  causes  item  drop;  (lo22  X  10  /year) 

•  an  operator  mishandling  impact  initiation  occurs  during  item 

-2 

packing  operations  (1,22  X  10  /year) 

•  impact  of  items  during  driverless  tractor  operations,  causes 
initiation  (8.47  X  10”^/year) 

•  item  impact  during  jib  crane  operations  due  to  operator  error 
causes  initiation  (6,86  X  10"Vyear) 

Other  equipment  damage  scenarios  include: 

•  damage  caused  by  operator  error  during  jib  crane  operations 
(6.24  X  10"^/year) 

•  damage  caused  by  control  failure  of  jib  crane  during  jib 
crane  operations  (1.66  X  10  /year) 

Similar  scenarios  to  most  of  these  have  already  been  described  for  other 
locations  in  the  preparation.  The  scenario  involving  operator  mishandling 
from  Cell  6  is  delineated  in  the  following  table: 

Fault  Tree  Probability/ 

Component  No.  Description  Frequency  Used 

89  Items  being  received  from  Cell  6  89/hr 

47  Operator  mishandling  error;  item  is  0.003 

dropped  or  impacted  (human  error) 

43  Impact  is  sufficient  for  initiation*  1.1  X  10  ^ 


*  This  probability  is  discussed  in  the  Priority  1  report 
3,2  ACCUMULATOR  BUILDING  AND  SMOKELESS  POWDER  CONVEYOR 


Based  on  the  fault  tree  analysis  of  the  Accumulator  System,  it  is  estimated 

that  the  probability  of  major  system  damage  occurring  is  0.343  per  year.  The 

major  scenarios  contributing  to  this  value  are  summarized  below: 

♦  Localized  Impact  Initiation  Scenarios  0.3024/yr 

(e.g,  dropped  tools  and  rough  handlings) 


•  Forklift  Penetrations  of  Type  III  Containers 
or  Equipment 

•  Impingement  due  to  Pinch  Valve  Boot  Leakage 

•  Filled  Type  III  or  MKIV  Container  Impacts 

•  Electrostatic  Discharge  from  an  Ungrounded  Operator 


2.61  X  lO'^/yr 

1.25  X  10"^/yr 
1,38  X  10"^/yr 
3.93  X  lO’^/yr 
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•  Frictional  Heating  due  to  a  Stuck  Roller  on  the  1.66 

Bel t  Conveyor 

•  Fire  Transfer  from  the  Preparation  Building  1.12 

•  Friction  at  Rubber  Receiving  Hopper  3.51 

•  Overheated  Bearings  on  Smokeless  Powder  Conveyor  2.87 

•  Initiation  due  to  Smoking  During  Maintenance  2.81 

t  Electrostatic  Discharge  from  an  Ungrounded  Type  III  2.6 

Container  During  Dust  Collector  Emptying 

•  Initiation  due  to  Imcompatible  Materials  in  Dust  2„6 

Collector  Duct 

•  Conveyor  Drive  Motor  Fire  Transfers  to  Conveyor  or  3.08 

Storage  Hopper 


•  Frictional  Initiation  of  Contamination  Between  a  Type  III  1.82 
or  MKIV  Container  and  a  Stuck  Roller  on  the  Gravity 

Roller  Conveyor 

•  Electrostatic  Discharge  due  to  a  Non-conducti ve  Gasket  1.25 
or  Air  Gap  at  the  Load  Point  Filling  Spout 

Those  categories  of  scenarios  with  estimated  frequencies  above 
are  discussed  in  the  remainder  of  this  section. 


X  10"^/yr 

X  10“Vyr 
X  10"^/yr 
X  lO’^/yr 
X  10"^/yr 
X  10‘^/yr 

X  10"^/yr 

X  10"®/yr 

X  10“^/yr 

X  10"^/yr 
lO^^/year 


Localized  Impact  Initiation  Scenarios  (0c3024/year) 

The  most  dominant  cut  sets  in  the  accumulator  fault  tree  were  found  to  be 
scenarios  in  which  a  fire  is  caused  by  an  operator  dropping  a  tool  or  other 
article  onto  a  layer  of  propellant  (dust  or  residue)  causing  initiation  to 
occur  by  impact.  Scenarios  in  which  impact  initiation  results  from  rough 
handling  of  equipment  or  tools  during  maintenance  (for  example  from  an 
operator  using  the  MKIV  container  lid  sealing  wrench  as  a  hammer  to  loosen  or 
tighten  the  lid)  were  also  included  within  this  category  of  events.  The 
scenarios  in  which  a  tool,  container  lid,  lid  sealing  wrench,  etc.  is  dropped 
causing  initiation  by  impact  made  up  the  largest  portion  of  these  incidents 
(0.237/year),  and  the  rough  handling  incidents  made  up  the  remaining  0.065/yearo 


The  highest  probability  scenario  in  this  category  was  an  operator  acci¬ 
dentally  dropping  a  tool  into  a  Type  III  container  during  emptying  of  one  of 
the  cyclones  or  dry  collectors  in  the  vacuum  system.  The  basic  components  of 
this  scenario  and  probability  values  that  were  used  are  provided  here: 
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Fault  Tree 


Component  No, 

Description 

Probability  Used 

373 

Vacuum  System  Component  is  being 
emptied  (not  a  wet  separator) 

5  X  10"^/hour 
(ie  8  vessels  every 
2  weeks) 

374 

A  tool  is  dropped  into  the  Type  III 
container  at  the  start  of  emptying* 

5  X  10"Vtrial 

375 

A  thin  layer  of  material  is  at  the 
drop  location 

0.1 

376 

Stimulus  causes  initiation 

1,0 

377 

Reaction  propagates  to  involve  ** 
a  significant  amount  of  material 

1.0 

*  Initiation  will  not  occur  once  a  thick  layer  of  powder  is  present  to 

-2  •  • 

cushion  the  impact.  A  human  error  probability  of  10  and  a  probability 
of  0o5  for  the  drop  being  early  are  used. 

**  It  is  likely  that  a  flame  produced  in  the  Type  III  container  v;ill  rise 
to  ignite  dust  still  within  the  hopper  being  emptied. 

In  this  scenario,  the  initiation  probability  of  1  (Component  376)  was 
based  on  a  tool  weighing  0.227  kg  (0o5  pound)  dropped  from  a  height  of  0.76m 

(30  inches)  onto  an  area  of  10"^m^  (1/8  inch  X  1/8  inch).  This  produces  an 

-S  *  2  .  .  . 

initiation  stimulus  level  of  1,69  X  10  j/m  and  a  corresponding  probability 
of  1. 

This  problem  area  can  be  minimized  by  enforcing  strict  management  con¬ 
trols.  Tools  should  be  tied  to  the  operator  on  a  short  cord  to  break  the  fall 
where  practical.  Personnel  should  be  trained  to  be  aware  of  the  potential  for 
initiating  propellant  dust  by  impact. 

Forklift  Penetrations  (2.6  X  10~^/year) 

This  category  of  events  involves  a  forklift  impacting  and  penetrating  a 
Type  III  container,  a  cyclone,  a  dry  collector  or  a  dust  collector  during  the 
emptying  operation.  If  the  material  inside  the  container  initiates  from  the 

event,  a  fire  or  explosion  would  occur.  However,  even  if  an  initiation  does 
not  occur,  penetrating  an  equipment  item  can  shut  down  the  operation  for  at 
least  several  days. 
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Fault  Tree  Probability 

Component  NOo  Description  Frequency  Used 


-3 

360  and  363  Forklift  is  used  to  move  a  6.25  X  10  /hour 

Type  III  container  during 
vacuum  equipment  emptying 

361  and  364  Forklift  impacts  and  penetrates  0.001 

a  full  Type  III  container  or 
equipment  item 

362  and  365  Penetration  results  in  an  initiation  1.0 

and/or  major  system  damage 


Licensing  of  forklift  drivers  will  serve  to  minimize  this  potential 
hazard. 

Impingement  Initiation  due  to  a  Leak  in  the  Pinch  Valve  Rubber  Boot 

(1.25  X  lO'^year) 

There  are  two  pneumatically  actuated  pinch  valves  in  the  Accumulator 
Building.  One  is  below  the  collection  and  storage  hopper,  and  the  other  is 
below  the  weigh  hopper.  The  valve  below  the  collection  and  storage  hopper 
will  be  kept  open,  except  during  infrequent  situations  in  which  an  unplanned 
special  maintenance  requires  that  propellant  be  held  in  the  storage  hopper. 
Conversely,  the  pinch  valve  below  the  weigh  hopper  is  actuated  each  time  a 
Type  III  or  MKIV  container  is  filled.  The  pinch  valve  contains  a  tube  shaped, 
thick  walled  rubber  "boot"  which  forms  a  linear  closure  when  air  pressure  is 
supplied.  After  many  closures,  the  boot  could  develop  a  leak  allowing  air  to 
jet  into  the  line.  The  air  jet  could  initiate  propellant  granules  in  the 
line  by  impingement  if  the  granules  can  be  accelerated  to  a  high  enough 
veloci  ty. 

Data  was  not  available  describing  the  expected  failure  rate  of  the  pinch 
valve's  rubber  boot.  A  failure  probability  of  10"^/cycle  corresponds  to  a 
boot  failure  of  this  type  occurring  about  once  every  8  years  based  on  an 
average  container  filling  rate  of  30/hour.  This  failure  rate  is  judged  to  be 
reasonable  and  somev^hat  conservative,  therefore,  10  ^/cycle  was  used  in  the 
analysis. 
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The  air  supply  to  the  pinch  valve  is  at  lOOpsig,  A  pressure  reducer 
drops  this  pressure  to  80psig  and  a  relatively  long  nominal  1/2  inch  tube 
carries  the  air  to  the  pinch  valve.  If  a  massive  hole  is  formed  in  the  rubber 
boot,  the  flow  within  the  tube  is  expected  to  be  subsonic  and  choked.  There¬ 
fore,  the  velocity  at  the  tube  exit  at  the  pinch  valve  will  be  sonic,  or  about 
302  m/s  at  the  exit  conditions.  Scaling  relations  for  an  unconfined  air  jet 
then  predict  that  the  jet's  center  line  velocity  will  be  302  m/s  out  to  8.3  cm 
(3.29  inch)  and  drop  to  165  m/s  at  15.3  cm  (6  inch).  Rather,  if  a  smaller  hole 
is  formed  in  the  boot  (e.9*  0.318  cm,  1/8  inch),  the  center  line  velocity  is 
calculated  to  be  312  m/s  out  to  2.09  cm  (.821  inch)  and  drop  to  85  m/s  in  7.62  cm 
(3  inches)  and  43  m/s  in  15.2  cm  (6  inches).  These  jet  velocities  are  quite 
high  from  an  impingement  initiation  standpoint,  but  this  is  very  little  space 
to  accelerate  a  large  propellant  grain  to  the  stream  velocity.  Small  grains 
could  be  accelerated  to  approach  the  jet  velocity  and  could  be  ignited  by 
impingement  according  to  available  data  for  propellant  grains  (for  some 
materials  the  TIL  is  as  low  as  2.85  m/s).  It  should  be  noted  that  high  grain 
velocities  can  only  be  obtained  when  the  hopper  is  fairly  empty;  otherwise 
the  grain  pile  will  diffuse  the  jet  air  flow  and  restrict  particle  movements. 


This  scenario 

is  summarized  below: 

Fault  Tree 
Component  No. 

Description 

Probability/ 
Frequency  Used 

240 

Pinch  valve  rubber  boot  develops 
a  major  leak  upon  closure 
closures  v  leaks  x 

hour  ■  ^  closure^ 

3  X  10“^/hour 

241 

Jet  air  flow  causes  impingement 
of  grains  at  high  velocities 

0.1  * 

242 

Impingement  stimulus  causes  initiation  1.0  * 

243 

Reaction  involves  a  significant 
of  propellant  material 

amount  1.0 

*  Whether  or  not  the  grains  can  be  accelerated  to  a  high  enough  velocity  to 
cause  initiation  depends  on  the  size  of  the  hole  in  the  rubber  boot.  A 
probability  of  one  in  ten  for  this  is  judged  to  be  a  reasonable  conserva¬ 
tive  estimate. 
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“3 

Impact  Initiation  of  a  Filled  Type  III  or  MKIV  Container  (1.38  X  10  /year) 

Several  scenarios  were  identified  in  which  a  filled  Type  III  or  MKIV 
container  experiences  an  impact,  for  example  due  to  being  dropped  or  swung  into 
an  object  during  a  jib  crane  maneuver.  The  highest  probability  scenario  in 
this  category  was  initiation  due  to  being  dropped  by  the  jib  crane.  This 
scenario  is  delineated  in  the  following  table: 


Fault  Tree  . 

Probability/ 

Component  No. 

2f)7 

Description 

Frequency  Used 

Jib  crane  is  used  to  manipulate 
full  Type  III  or  MKIV  container 

30/hour 

209 

Hook  to  container  is  not  securely 
fastened,  resulting  in  impact 
i  ni  ti ati on 

0.001  * 

r 

208 

Resultant  impact  causes  initiation 

lol  X  10"^ 

*  Human  error  probability 

**  It  should  be  noted  that  the  value  of  Id  X  10"^  is  for  dropping  a  bomb  or 
full  munitions  item.  It  is  judged  to  be  extremely  conservative  for  a 
container  holding  loose  propellant.  However,  in  the  absence  of  better 
data  this  value  v/as  adopted. 

-4 

Electrostatic  Discharge  from  an  Ungrounded  Operator  (3.93  X  10  /year) 

A  number  of  scenarios  were  identified  in  which  an  operator  wears  improper 
shoes  or  clothing  into  an  area  where  propellant  or  a  contaminant  is  exposed. 
The  operator  becomes  electrically  charged  and  discharges  at  the  propellant  or 
contaminant  resulting  in  an  initiation.  A  typical  scenario  of  this  type  is 


described  below: 

Fault  Tree 
Component  No. 

Description 

Probability/ 
Frequency  Used 

248 

Operator  wears  ungrounded  shoes 
or  dielectric  clothing  into  area 

1.25  X  10"^, 

249 

Area  supervisor  or  other  personnel 
do  not  stop  him 

0.35 

250 

The  operator  develops  a  charge 

0.8 

251 

The  operator  discharges  at  exposed 
explosive 

0.5 

252 

ESD  stimulus  causes  initiation 

0.05 

253 

Reaction  propagates  to  the  bulk  of 

material  present. 
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The  value  of  0.8  for  the  operator  developing  a  charge  is  related  to  the 
fraction  of  time  in  a  year  that  the  air  is  dry.  The  value  is  conservative  in 
that  a  person  will  not  necessarily  become  charged  only  by  wearing  ungrounded 
shoes  on  a  dry  day.  For  example,  walking  on  a  carpet  is  more  likely  to  create 
a  charge  than  walking  on  a  concrete  flooro  Nonetheless,  strict  management  con¬ 
trols  should  be  enforced  to  assure  that  operators  wear  proper  clothing  in  the 
area  and  cannot  develop  an  electrical  charge  on  their  bodies. 

Frictional  Heating  due  to  a  Stuck  Roller  on  the  Belt  Conveyor 

(1.66  X  IQ-Vyear) 

According  to  reference  1  about  20  percent  of  bearing  failures  result  in 
binding.  In  the  extreme,  a  bearing  that  is  binding  will  freeze  completely  and, 
in  the  case  of  the  smokeless  powder  conveyors  can  cause  a  stuck  roller.  When 
a  roller  becomes  stuck,  if  the  drive  motor  does  not  stall  due  to  the  increased 
load,  the  conveyor  belt  will  continue  to  rub  across  the  roller  over  its  contact 
area  with  the  roller.  This  rubbing  will  heat  the  roller  due  to  friction. 
Transient  heat  transfer  models,  described  in  Appendix  D  have  been  used  to  esti¬ 
mate  the  temperature  rise  due  to  a  stuck  roller.  Top  rollers,  bottom  rollers, 
the  lower  end  roller,  and  the  various  gravity  takeup  rollers  were  evaluated 
using  the  model So  For  the  top  rollers,  it  was  estimated  that  each  roller  will 
experience  a  load  of  about  11  kg  (23.5  lb)  due  to  the  propellant  on  the  belt 
and  the  weight  of  the  belt  itselfo  This  will  generate  about  2.9  Btu/min  which 
will  raise  the  temperature  to  about  250°F  (121°C)  in  an  hour.  Sixty  three 
percent  of  this  temperature  rise  would  be  reached  within  about  five  minutes. 

For  the  bottom  rollers,  the  temperature  is  estimated  to  rise  to  below  230°F 
(110°C). 

Some  propellants  have  autoignition  temperatures  as  low  as  118°C  (more 
typically  200°C),  and  rubber  has  an  ignition  temperature  significantly  higher. 
Therefore,  some  fraction  of  propellants  could  be  ignited  but  the  belt  itself 
is  very  unlikely  to  start  burning  due  to  the  friction  alone. 

For  the  lower  end  roller,  the  frictional  heating  would  depend  on  the 
belt  tension  produced  by  the  gravity  takeup  unit.  It  was  judged  that  the 
gravity  takeup  unit  would  typically  require  about  300  lb  of  weight  -  the 
maximum  possible  gravity  takeup  load  was  estimated  to  be  1000  lb.  For  the 
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"typical"  belt  tension,  the  stuck  roller  heating  rate  was  calculated  to  be 
58  Btu/min.  This  would  raise  the  roller  temperature  to  nearly  1200°F  (649°) 
in  an  hour,  and  to  about  600°F  (316°C  )  in  the  first  ten  minutes.  These  esti¬ 

mates  indicate  that  if  the  conveyor  continues  to  operate  with  the  lower  end 
roller  frozen,  propellant  contamination  would  be  ignited  and  the  belt  would 
melt  or  start  to  burn.  However,  it  is  questionable  whether  the  drive  motor 
would  continue  to  operate  under  such  a  heavy  load. 


Based  on  these  analyses,  the  probabilities 
type  of  roller  v/ere  derived  as  follows: 
top  rollers 
lower  end  roller 
upper  gravity  takeup  roller 
lower  roller 

lower  gravity  takeup  roller 


per  year  of  initiation  for  each 

1.35  X  10"Vyr 
2.34  X  10"^/yr 
2.66  X  10”®/yr 
3c62  X  lO'^/yr 
1.33  X  10"^/yr 


The  estimated  probabilities  were  due  in  part  to  the  predicted  temperature  rise 
and  in  part  to  the  number  of  rollers  of  a  given  type  that  are  present. 


A  typical  scenario  for  a  top  roller  becoming  stuck  and  heated  by  belt 
friction  is  delineated  below: 


Fault  Tree  Probability/ 

Component  No.  Description  Frequency  Used. 

85  Bearing  fails  causing  stuck  roller  1.8  X  10~^/hr  * 

86  Friction  heat  ignites  contaminant  0.1  ** 

or  belt 

87  Fire  propagates  to  powder  on  belt  0,005  *** 

31  Deluge  system  response  is  too  slow  to 

prevent  significant  damage 

*  120  rollers  (240  bearings)  with  a  bearing  failure  intensity  of  4  X  10"  /hr 

of  which  20  percent  are  binding  failures, 

**  Represents  approximate  fraction  of  propellants  that  would  be  ignited  at 
the  temperature  achieved. 

***  Initiation  of  contaminant  under  belt  would  not  easily  propagate  to 
propellant  batches  on  top  of  belt.  Propellant  batches  on  top  of  belt 
are  spread  well  apart  and  generally  v/ould  not  be  at  the  stuck  roller 
at  the  right  time. 
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Fire  Transfer  from  Preparation  Building  (1.12  X  10  ^/year) 

Scenarios  were  considered  in  which  a  fire  in  preparation  building  Cell  5 
or  an  explosion  in  Cell  6  ignites  propellant  on  the  smokeless  powder  conveyor. 


probabilities 

for  fire  in  Cell  5  and  explosion  in  Cell 

6  were  derived  from 

fault  trees  for  the  preparation  building. 

These  two  types  of  scenarios  are  outlined  below: 

Fire  Transfer  Due  to  Fire  in  Cell  5 

Fault  Tree 
Component  No. 

Description 

Probability/ 
Frequency  Used 

17 

Fire  occurs  in  Cell  5  and  transfers 
to  conveyor 

5.4  X  10“^/hr 

31 

Deluge  system  response  is  too  slow 
to  prevent  propagation 

0.02 

Fire  Transfer  Due  to  Explosion  in  Cell  ( 

Fault  Tree 
Component  No. 

Description 

Probability/ 
Frequency  Used 

21 

Explosion  occurs  in  preparation 
building 

2.45  X  10"®/hr 

22 

Explosion  blows  out  blast  panels 

1.0 

23 

Blast/ fragments  penetrate  conveyor 
housing 

0.1 

24 

Blast/ fragments  cause  conveyor  fire 

0,1  * 

31 

Deluge  system  response  is  too  slow 
to  prevent  propagation 

0.02 

*  propellant  piles  are  spread  far  apart  on  the  conveyor 

r- 

Friction  at  Pxubber  Receiving  Hopper  (3,51  X  10  ^/vear) 

If  the  rubber  receiving  hopper  at  the  conveyor  entrance  is  adjusted  (or 
manufactured  too  large)  to  contact  the  moving  conveyor  belt,frictional  heating 
will  occur  where  the  hopper  rubs  the  conveyor.  If  the  contact  force  is  2  lb, 
it  is  calculated  that  the  temperature  at  the  interface  will  rise  to  about  100°F 
(38°C)  in  15  minutes.  If  the  force  is  10  lb,  about  280°F  (139°C)  will  be 
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reached  v/ithin  a  half  hour.  These  calculations  are  based  on  half  the  energy 
that  is  generated  being  carried  away  with  the  belt,  and  the  other  half  being 
used  to  heat  up  the  rubber  hopper  flaps o  These  calculations  indicate  that  if 
the  flaps  are  set  to  push  down  on  the  conveyor  belt  with  a  low  force  (most 
likely  the  case)  the  temperature  would  not  rise  significantly.  However,  if  a 
nominal  force  (only  10  lb)  is  applied,  the  temperature  could  rise  to 
initiate  propellant  present.  Setting  the  hopper  to  contact  the  belt  with  such 

a  high  force  is  considered  as  a  severe  human  error  in  the  scenario  described 

_2 

here  (i.e.  probability  less  than  10  ): 


Fault  Tree 
Component  No. 

115 


116 

117 

31 


Description 


Probability/ 
Frequency  Used 


Rubber  receiving  hopper  is  set  too 
tight  against  conveyor  belt 
(rubbing  occurs) 

Temperature  rise  ignites  powder  present 

Fire  propagates  to  powder  on  belt 

Deluge  system  response  is  too  late 
to  prevent  propagation 


2.4  X  10"^/hr 


loO 

1.0 

0.02 


Set  once  per  year  with  a  human  error  probability  of  0.001. 
may  not  be  conservative  in  this  case. 


Once  per  year 


**  Propellant  will  be  dumped  at  that  location  each  cycle. 

Overheated  Bearings  on  Smokeless  Powder  Conveyor  (2.87  X  10  ^/year) 

The  transient  heat  transfer  models  described  in  the  appendix  were  used  to 
estimate  the  temperature  rise  of  a  roller  bearing  on  the  smokeless  powder  con¬ 
veyor  for  the  case  v/ere  binding  starts  to  occur,  e.g.,  lubrication  is  losto 
The  weight  loading  used  in  the  calculations  and  resultant  temperature  rise  are 


summarized  below 

for  the  different 

rollers  in 

the  system: 

Roller  Location 

Load/Bearing 
.(lb)  .. 

Heat 

Generati on 
( Btu/Mi n ) 

Temperature 
Rise  Range* 

Time  for 
Temperature 
Rise  (Min) 

Top  Roller 

14.5 

0.48 

105°F  (4rC)  to 
170°F  (77°C) 

>  15  to  30 

Lower  Roller 

25.0 

0o79 

125°F  (52°C)  to 
225°F  (77°C) 

20  to  35 

Lower  End  Roller 

100.5  ** 

2.2 

95°F  (35°C)  to 
250°F  (121°C) 

10  to  45 

Top  End  Roller 
(Drive  Roller) 

36 

7.8 

180°F  (83°C)to 
660°F  (349°C) 

35  to  60 

*  Range  brackets  expected  result.  The  low  value  is  based  on  an  optimistic  fin 
geometry  and  the  high  value  is  based  on  the  worst  case  geometry  used  in  the 
one  dimensional  fin  model  described  in  the  appendix. 

**  Based  on  300  lb  of  weight  in  gravity  take-up  unit. 
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The  worst  case  rollers  for  overheating  bearings  are  those  that  experience 
the  highest  loads  from  the  gravity  take  up  unit.  These  are  the  rollers  at  the 
gravity  takeup  unit  and  the  top  end  roller. 

A  typical  overheated  bearing  scenario  (i.e.  for  the  top  end  roller)  is 
described  below: 


Fault  Tree 

Probabil ity/ 

Component  No. 

Description 

Frequency  Used 

78 

A  top  end  roller  bearing  fails 
causing  overheating  to  occur 

1.6  X  10“^/hr 

79 

The  hot  bearing  ignites  contaminant 
present 

;  0.1  * 

80 

Fire  propagates  to  powder  on  belt 
or  in  storage  hopper 

0.5  ** 

31 

Deluge  system  response  is  too  late 
to  prevent  propagation 

0.02 

*  This  includes  a  probability  of  1  in  10  that  a  contaminant  is  present  at 
the  bearing  and  a  probability  of  1.0  that  the  bearing  temperature  causes 
ignition. 

**  A  spark  would  be  produced  which  could  fall  into  the  storage  hopper.  The 
spark  may  or  may  not  have  sufficient  energy  to  cause  an  ignition  once  in 
contact  with  the  propellant  in  the  storage  hopper. 

Smoking  During  Maintenance  (2.81  X  10  ^/y4ar) 

It  is  clear  that  smoking  must  be  prohibited  and  "no  smoking"  strictly 
enforced  during  operation  or  maintenance  and  in  general  anywhere  within  the 
perimeter  of  the  operating  areas  of  the  WADF  facility.  This  category  of 
scenarios  represent  an  obvious  hazard,  but  have  a  clear  solution  (strict 
management  controls),  therefore,  no  further  discussion  is  necessary. 

Electrostatic  Discharge  From  an  Ungrounded  Type  III  Container  During  Dust 

(2.6  X  10~Vyear) 

It  is  judged  that  the  dust  collectors  will  require  emptying  about  once 
every  two  weeks.  During  emptying, a  Type  III  container  is  partially  filled 
with  water  and  placed  beneath  the  dust  collector  hopper.  The  water  will 
prevent  dusting  and  inert  the  powder  that  has  fallen  into  the  Type  III  con¬ 
tainer.  If  the  container  is  partially  filled  with  water  an  initiation  is  not 
likely.  If  the  water  is  omitted  and  the  Type  III  container  is  not  bonded  to 
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the  dust  collector  during  the  cleaning  operation,  dust  rising  from  the  con¬ 
tainer  could  become  ignited  by  an  electrostatic  discharge.  Such  a  discharge 
would  be  caused  by  a  voltage  difference  developing  between  the  Type  III  con¬ 
tainer  and  the  dust  collector  during  the  emptying  operation.  If  the  material 
in  the  dust  cloud  and/or  Type  III  container  is  ignited,  the  resultant  fire 


ball  would  rise  to  the  dust  collector  hopper  and  could  ignite  material  in  the 
hopper.  In  addition,  the  operator  who  is  present  could  be  seriously  injured 
during  the  event. 


Paul t  Tree 
Component  No. 

303 

304 

305 

321 

322 

323 

324 

325 


Probability/ 

Descri ption  Frequency  Used 

_3 

Dust  collector  is  emptied  6.25  X  10  /hr 

(once  per  2  weeks) 

Sufficient  water  is  not  put  into  0.001 

the  Type  III  container  prior  to 

emptying 

A  significant  amount  of  material  is  1.0 
present  at  the  time  of  initiation 


The  type  III  container  is  not  bonded  0.001 
to  the  storage  receptacle 


The  Type  III  container  becomes  charged  1.0 

The  Type  III  container  discharges  to  1.0 
the  storage  receptacle  or  operator 


The  discharge  occurs  at  the  material  1.0 
being  dumped  or  resultant  dust  cloud 


ESD  stimulus  causes  initiation  1.0 


Initiation  Due  to  Incompatible  Materials  in  the  DuSt  Collector  Duct 

(2.1  X  10~^/year) 


Based  on  the  compatibility  study  presented  in  the  Priority  1  report,  it  is 
not  likely  that  incompatible  propellants  or  explosives  will  be  present  in  the 
dust  collection  ducts  at  the  same  time,  particularly  at  ambient  temperatures. 
However,  in  the  quantification  of  this  scenario  a  probability  of  1  was  used  to 
account  for  uncertainties  and  to  assure  conservatism.  Therefore,  the  estimated 
frequency  for  this  scenario  is  judged  to  be  somewhat  high. 
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Fault  Tree 
Component  No. 


Description 


Probability/ 
Frequency  Used 


284 

A  significant  dust  layer  builds  up  on  6,25 
dust  collector  duct  walls 

X  10"^/hr 

288 

Dust  layer  contains  strongly  incompatible 
materials  (severe  human  error) 

10"^ 

289 

The  incompatibility  results  in  a  fire 

1,0 

290 

Reaction  spreads  to  involve  a  significant 
amount  of  material. 

1.0 
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3.3  MECHANICAL  REMOVAL  BUILDING 


3.3.1  Mechanical  Removal  Building,  Cell  2  (Small  Band  Saw) 


The  fault  tree  analysis  for  the  small  band  saw  gave  an  expected  failure 
frequency  of  19.82/yr.  The  main  categories  of  failure  scenarios  identified  are 
listed  below. 

•  Impact  initiation  of  sawed  "head"  of  Mk4  depth  charges  (13.3/yr) 

-  due  to  impact  with  tray  (13o0/yr) 

-  due  to  impact  with  floor  (.255/yr) 

•  Electrostatic  discharge  from  plastic  sheets  used  to  cover  (6.24/yr)* 
sectioriGd  strnmunition  it6ms 

•  Initiation  during  sawing  operation  (.182/yr)* 

-  due  to  saw  blade  misalignment  (6.5  X  10  /yr) 

-  due  to  improper  force/speed  setting  (6.5  X  10  /yr) 

(5.2  X  10"^/yr) 


f 

t 


-  due  to  thermal  initiation 

Initiation  of  contamination  within  cell  by  a  dropped  tool 
Initiation  due  to  item  mishandling 

-  due  to  forklift  tine  penetration  of 2 
steel  cover  of  item  (4.16  X  10  /yr) 

-4 

-  during  jib  crane  operations  (5.72  X  10  /yr) 
during  item  transfer  from  DLT  to  forklift 

-  due  to  drop  by  forklift  (1.37  X  10  ^/yr) 

Initiation  of  contamination  while  loading/unloading  carrier 
plate  (7o8  X  10"Vyr) 


(5.24  X  10"^)* 
(4.22  X  10"^/yr) 


(2.28  X  10"^/yr) 


In  many  respects,  the  small  band  saw  is  similar  to  the  large  band  saw  in 
Cell  B  of  the  Large  Cells  described  in  Section  3.3.5.  Not  surprisingly,  certain 
scenarios  which  are  dominant  for  the  small  band  saw  analysis  are  likewise  domi¬ 
nant  in  the  large  band  saw  tree.  The  starred  categories  (*)  above  are  so  similar 
to  the  large  cell  categories  that  their  discussion  is  deferred  until  Section 
3.3.5.  The  only  change  in  the  cutsets  presented  there  is  the  throughput  rate 
for  the  cell,  which  is  50  items/shift,  roughly,  in  the  case  of  the  small  band 


sawo 

The  remaining  categories  of  scenarios  are  described  in  detail  below: 

Impact  Initiation  of  Residual  Explosive  in  Sawn  Heads  of  Mk4  Depth  Char-oes  (13.3/yr) 

Two  scenarios  have  been  identified  involving  the  impact  initiation  of  ex¬ 
plosive  left  in  the  head  of  a  Mk4  depth  charge  after  it  has  been  cut  from  the 
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main  body  of  the  depth  charge.  The  depth  charges  are  placed  in  a  fixture  on  the 
carrier  plate,  three  at  a  time,  inclined  at  an  angle  so  that  the  saw  blade  will 
contact  the  sloping  surface  of  the  depth  charge  at  a  right  angle.  Attached 
to  the  end  of  the  carrier  plate  is  a  tray  into  which  the  "heads"  of  the  charges 
should  drop  as  they  are  severed.  Both  scenarios  postulate  that  the  action  of 
the  band  saw  smears  some  of  the  now  exposed  explosive  over  the  lip  of  the 
fresh  cut.  The  head  then  lands  on  the  portion  of  the  lip  over  which  the 
explosive  has  been  smeared,  resulting  in  an  impact  initiation.  In  the  first 
scenario,  the  head  lands  in  the  tray  as  planned.  In  the  second,  a  "snag"  of 
the  blade  on  the  head  in  the  final  stages  of  the  cut  throws  the  sawn  head  over 


the  tray,  where  it 

are  listed  below. 

impacts  the  floor.  The  components  and 

failure  probabilities 

Fault  Tree 

Probability/ 

Component  No. 

Description 

Frequency  Used 

153 

Sawing  operation  is  begun  on  item 

6.25/hr 

154 

Head  falls  into  tray 

1.0 

155 

Head  lands  on  contaminated  lip 

.01 

156 

Impact  results  in  initiation 

.05 

The  frequency  for  this  scenario  is  13.0/yr.  The  explosive  in  the  head 
will  probably  be  wet  due  to  the  coolant  used  in  the  sawing  process.  The  initia¬ 
tion  probability  used  in  the  last  item  is,  therefore,  based  on  threshold 
initiation  levels  for  25  percent  wet  in-process  forms  of  RDX  and  TNT.  A  weight 
of  3  lbs  for  the  head,  and  a  drop  of  6"  v;ere  used  in  the  calculation  of  the 
impact  energy,  and  an  impact  area  of  1/8"  X  1/8"  was  used  to  estimate  the  impact 
area.  An  impact  energy  per  unit  area  of  20.2  X  10^  J/m^  was  calculated.  This 
value  is  bracketed  closely  by  TIL  values  for  25  percent  wet  RDX  (16  X  10^  J/m^  to 
24  X  10^  J/m^  and  25  percent  wet  TNT  (15  X  10^  J/m^).  20  X  10^  J/m^  was  used 
as  a  TIL  value. 

The  second  scenario  is  similar. 

Fault  Tree  Probability 

Component  No.  Description  Frequency  Used 


157 

Sawing  operation  is  begun  on  item 

6.25/hr 

158 

Head  is  thrown  clear  of  tray 

,001 

159 

Head  lands  on  contaminated  lip 

.01 

160 

Impact  results  in  initiation 

.98 
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The  frequency  for  this  scenario  is  .255/yr.  The  estimate  for  initiation  ^ 
probability  in  the  last  component  is  based  on  an  extrapolation  of  20  X  10  J/m 
as  a  TIL  value  for  dampened  explosive  as  described  for  the  previous  scenario. 
The  extrapolation  is  based  on  a  normal  probit  curve  for  dry  HBX-1. 


It  is  expected  that  in  either  of  the  above  cases,  the  initiation  of  one 
pound  of  explosive  in  the  "head"  of  the  item  may  cause  sympathetic  initiation 
in  the  three  depth  charges  present.  It  is  strongly  recommended  that  the  fix¬ 
ture  and  carrier  plate  be  redesigned  so  that  the  "head"  is  secured  and  does  not 
fall  freely  after  sawing. 

Initiations  due  to  Mishandling  (4.22  X  10  ^/yr) 


Several  scenarios  were  identified  in  which  items  were  initiated  by  impact 
due  to  mishandlings.  These  scenarios  are 


•  Penetration  of  the  steel  case  of  an  item  by  a  fork 
1 ift  tine 


(4.16  X  lO'^/yr) 


•  Drop  of  an  item  from  the  jib  crane  during  loading/ 
unloading  of  the  carrier  plate 

•  Rough  handling  during  pickup  of  item  by  forklift 
at  the  driverless  tractor 

•  Rough  handling  and  drop  of  an  item  during  forklift 
transport 


(5.72  X  10‘Vyr) 

(2.28  X  lO’^/yr) 
(1.37  X  10"^/yr) 


The  first  of  these  scenarios  is  described  in  detail  in  Section  3.3.5  on 
the  large  band  saw.  As  a  typical  example,  the  second  scenario  is  presented 
below. 


Paul t  Tree 
Component  No. 

Description 

Probability/ 
Frequency  Used 

64 

Item  prepared  for  sawing 

12.5/hr 

65 

Jib  crane  used  to  load  item  on 
carrier  plate 

1.0 

67 

Operator  error  causes  item  to  drop 

.001 

66 

Impact  results  in  initiation 

1.1  X  10  ^ 

The  probability  of  initiation  is  derived  from  data  compiled  during 


Vietnam.  12.5/hr  is  twice  the  throughput  rate,  once  for  loading  and  once  for 
unloading.  Such  incidents  may  be  minimized  with  strict  management  controls 
and  proper  operator  training. 
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Impact  on  a  Contaminated  Fixture  Whil6  Loading  Carrier  Plate  (7«8  X  10 


This  scenario  consists  of  a  mixture  of  human  errors,  in  which  good  house¬ 
keeping  is  neglected,  allowing  substantial  contamination  to  build  up  on  the 
carrier  plate,  and  rough  handling  of  an  item  which  ignites  the  contaminant. 


Fault  Tree 
Component  No, 

243 

244 

245 

246 

247 

248 


Description 


Probability 
Frequency  Used 


Item  is  loaded  aboard  fixture  using 
jib  crane 

Fixture  has  been  left  contaminated 
with  explosive 

Due  to  rough  handling,  item  impacts 
fi xture 

Contaminant  present  at  impact  point 
Contaminant  initiates 

Propagation  to  surrounding  contamination 
occurs 


6.25/hr 

.001 

.003 

0.1 

1.0 

0.1 


In  calculating  the  energy  per  unit  area  for  the  impact,  an  item  weight  of 
50  lbs  v^as  used,  and  velocity  of  1  ft/sec.  An  impact  area  of 
also  used.  Energy  per  unit  area  was  calculated  to  be  1.05  X  10  J/m  .  This 
value  gives  a  very  high  probability  of  initiation  for  virtually  all  explosives 
of  interest. 

It  is  expected  that  the  likely  outcome  of  the  scenario  is  a  severe  burn 
for  the  operator.  Strict  management  controls  and  ongoing  hazard  training  are 
again  recormiended. 
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3„3o2  Mechanical  Removal  Building  Cell  3  (Hole  Sawing  Operations) 


Based  on  the  fault  tree  analysis  of  Cell  3  in  the  mechanical  removal 

building,  for  the  hole  sawing  system,  it  is  estimated  that  the  probability 

of  major  system  damage  occurring  is  7.606  X  10  per  year.  The  major 

scenarios  contributing  to  this  value  are  summarized  below: 

Localized  impact  initiation 

Forklift  penetration  of  item 

Electrostatic  discharge  from  an 
ungrounded  operator 

Item  being  dropped  during  ' 
loading,  unloading  or  trans¬ 
porting 

Cutter  dulls  and/or  breaks-up 


7.291  X  10‘^/yr 
2.626  X  10"^/yr 
3.554  X  10“ Vr 

1.480  X  10“^/yr 


1.300  X  10  7yr 


In  the  following  sections  each  of  the  above  scenarios  are  discussed. 
Localized  Impact  Initiation  Scenarios  (  7.291  X  10“^/yr  ) 

The  most  dominant  cut  sets  in  Cell  3  of  the  mechanical  removal  building 
hole  sav/ing  system  fault  tree  were  found  to  be  scenarios  in  which  an  initiation 
is  caused  by  the  item  impacting  some  contamination  (dust  or  residue  of  explo¬ 
sive).  Dominant  was  the  pinching  and/or  impacting  explosive  contamination  on 
the  carriage  and/or  rollers  during  loading  of  large  and  heavy  munition  items. 
The  scenario  in  which  the  munition  item  impacts  some  explosive  on  the  equip¬ 
ment  causing  initiation  made  up  the  largest  portion  of  these  incidents 
(7.28  X  10  /yr)o  In  the  other  incidents  which  made  up  the  remaining  8.69  X 
10“^/yr,  tools  are  dropped,  munition  items  are  impacted  against  other  objects/ 
walls,  or  tools  impact  explosive  contaminants  during  maintenance  procedures. 


The  basic  components  of  the  highest  probability  scenario  and  the 
probability  values  that  were  used  are  as  follows: 
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Fault  Tree  Probability/ 

Component  No.  Descri ption  Frequency  Used 


105 

Item  being  processed  at  mechanical 
removal  building  Cell  3 

1.25  items/hr 

106 

Contamination  allowed  to  accumulate 
on  carriage  and  rollers 

1.0  X  10""^  * 

107 

Dust  pinched/impacted  during 
loading  of  item 

1.0 

108 

Pinch/impact  sufficient  to  cause 
cause  initiation 

0o28 

o 

109 

Reaction  propagates  to  item/other 
i  terns 

1.0  X  lO""^ 

*Assumed  that  clean-up  procedure  were  omitted,  therefore,  a  human  error  of 

-2 

omission  probability  of  10  was  used. 

In  this  scenario,  the  initiation  probability  of  0.28  (Component  108)  was 
based  on  an  empty  item  weighing  387.8  kg  (855  pounds)  being  lowered  by  the  jib 
crane  at  a  velocity  of  7.62  X  lO”^  m/sec  (3  in/sec)  onto  an  area  of  10"^m 
(1/8  inch  X  1/8  inch).  This  produced  an  initiation  stimulus  level  of  2.79  X 
10^  J/m^  and  a  corresponding  probability  of  0.28. 

This  problem  can  be  minimized  by  the  enforcement  of  strict  house  cleaning 
procedures  so  that  explosive  contamination  is  not  allowed  to  accumulate  on 
equipment.  All  personnel  should  be  made  aware  of  the  potential  for  initiating 
explosive  contaminants  by  pinch  or  impact. 

Forklift  Penetration  of  Item  (2.626  X  10  ^/yr) 

The  second  most  dominant  category  of  events  involves  a  forklift  truck 
impacting  and  penetrating  the  Mark  25  or  39  mine.  If  the  residual  material 
inside  the  mine  initiates  from  this  impact/ penetration  a  fire  or  an  explosion 
would  result  (washed  out  items  can  have  up  to  4.54  kg  (10  pounds)  of  explosive 
in  them).  Note,  also  that  each  washed  out  item  is  only  visually  inspected  to 
determine  the  amount  of  explosive  present.  Operators  could  allow  items  with 
more  than  the  designated  amount  of  explosive  to  leave  the  washout/steamout 
area  and  enter  the  hole  sawing  facility.  Regardless,  even  if  an  initiation 
does  not  occur,  penetrating  an  item  is  certainly  not  recommended.  Forklift 
truck  drivers  should  be  well  trained  and  proficient  in  the  operation  of  fork¬ 
lifts  so  as  not  to  bump  into  equipment,  walls,  etc.  since  misused/damaged 
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equipment  v/ill  interrupt  production  which  would  result  in  lost  time  and  a 
costly  operation.  The  basic  components  of  this  scenario  and  the  probability 
values  that  were  used  in  the  analysis  are  as  follows; 

Fault  Tree  Probability/ 

Component  No.  Description  Frequency  Used 


401 

Item  brought  to  load/unload  area 

1.25  items/hr 

402 

Item  washed  out(less  than  10  lb. 
of  explosive) 

1.0 

403 

Prongs  used  on  item 

1.0 

404 

Prongs  at  proper  height  to  impact 
item 

10“^ 

405 

Prongs  puncture  item 

10"^ 

406 

Impact  sufficient  to  cause  initiation 

1.0 

p 

407 

Reaction  propagates  to  bulk  of 

10"^ 

explosive 

To  verify  that  the  forklift  truck  can  indeed  penetrate  a  Mark  25  mine, 
the  analysis  was  based  on  a  shear  strength  for  mild  steel  of  2.41  X  10  Pa 
(35,000  psi)  with  the  forklift  truck  traveling  at  8.05  m/hr  (5  mph)  and 
■  weighing  907.2  kg  (2000  pounds),,  The  forklift  truck  produced  an  energy  of 
2268J  vihile  it  only  required  494J  to  penetrate  a  mild  steel  cylinder  56.9  cm 
(22.4  inches)  in  diameter  and  a  0.635  cm  (1/4  inch)  wall  with  a  fairly  sharp 
prong  on  the  truck.  Therefore,  there  is  a  good  chance  that  when  a  forklift 
truck  prong  impacts  a  mine,  it  will  penetrate  the  wall  of  the  mine. 

Electrostatic  Discharge  From  an  Ungrounded  Operator  (3.554  X  10  ‘^/year) 

This  category  of  events  involves  operators  and/or  maintenance  personnel 
wearing  ungrounded  shoes  or  dielectric  clothing.  A  number/of  scenarios  were 
identified  in  which  personnel  wear  improper  shoes  or  clothing  into  areas 
where  explosives  or  a  contaminant  is  exposed.  The  personnel  becomes  electri¬ 
cally  charged  and  discharges  at  the  explosive  or  contaminant  resulting  in  an 
initiation.  A  typical  scenario  of  this  type  is  as  follows: 
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Fault  Tree 

Probability 

Component  No. 

Description 

Frequency  Used 

o 

241 

Operator  enters  cell  to  service 

1.923  X  10"^ 

used  filter  media  container 

_-5 

242 

This  operator  is  wearing  ungrounded 
shoes  in  area 

10 

243 

Supervisor  does  not  stop  him 

0,5 

244 

Other  personnel  do  not  stop  him 

0,7 

245 

Operator  develops  a  charge 

00  1 

0  O 

O  r- 

248 

Discharges  to  exposed  explosive  on 
filter  media 

246 

Sufficient  energy  to  cause  initiation  0.12 
of  explosive 

247 

Reaction  propagates  to  bulk  of 
explosive  in  deep  bed  filter  unit 

1.0 

The  value  of  0.8 

for  the  operator  developing  a  charge  (component  245) 

is  related  to  the  fraction  of  time  in  a  year  that  the  air  is  dry  at  the 
Hav^thorne  facility.  The  value  is  conservative  in  that  a  person  will  not 
necessarily  develop  a  charge  simply  by  wearing  ungrounded  shoes  on  a  dry 
day.  For  example,  walking  on  a  carpet  or  sliding  on  a  car  seat  is  more  likely 
to  create  a  charge  than  say  walking  on  a  concrete  floor.  Nonetheless,  strict 
management  controls  should  be  enforced  to  assure  the  personnel  wear  proper 
clothing  in  the  area  and  cannot  develop  an  electrical  charge  on  their  bodies 
and/or  clothing. 

Cutter  Dulls  and/or  Breaks-up  (1.30  X  10  ^/year) 


A  number  of  scenarios  were  identified  in  which  the  operator  sets  the 
wrong  cutter  speed  and  feed,  or  the  cutter  controls  fail,  or  cutters  are  not 
replaced  at  regular  intervals  which  results  in  a  dull  cutter  or  cutter  break-up 
especially  in  a  cutting  situation  such  as  being  performed  in  Cell  3  (inter¬ 
rupted  cuts).  A  typical  scenario  of  this  type  is  described  below: 


Fault  Tree 

Probability 

Component  No. 

Description 

Frequency  Used 

126 

Item  being  processed  in  Cell  3 

1.25  items /hr 

127 

Cutter  dulls,  overheats,  and/or 
breaks  up  creating  temperature  rise 
or  sparks 

0.2 
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Fault  Tree  Probability 

Component  No.  Description  Frequency  Used 


128 

Temperature  rise/sparks  contact 
explosive 

1.0 

129 

Thermal  initiation  results  or  spark 
sufficient  to  cause  initiation 

2.5  X  10' 

130 

Sufficient  amount  of  explosive  to  form 
a  train 

10“^ 

131 

Coolant  jet  does  not  suppress  reaction 

1.0 

132 

Reaction  propagates  to  item  or  other 

1.0 

items 

The  value  of  10"^  for  sufficient  amount  of  explosive  to  form  a  train 
(component  130)  is  related  to  human  errors.  The  first  error  is  at  the  washout/ 
steamout  where  the  item  is  not  completely  washed  out.  The  second  human  error  is  when 
the  item  is  not  autoclaved  correctly, and  finally  the  last  human  error  is  when 
at  the  mechanical  removal  building  the  operator  fails  to  inspect  item  prior  to 
loading  it  into  Cell  3  for  hole  sawing.  It  is  IITRI's  belief  that  the  hole 
cutters  v/i  1 1  have  a  very  short  cutting  life  due  to  the  interrupted  cuts  being 
performed  on  the  item.  This  short  life  will  interfere  with  production  and 
will  be  fairly  costly.  Nonetheless,  strict  cutter  inspection  is  recommended 
(after  each  item)  to  make  certain  cutters  are  sharp  so  as  to  reduce  the  possi¬ 
bility  of  cutter  break-up. 


IIT  RESEARCH  INSTITUTE 


42 


3o3o3  Mechanical  Removal  Building,  Cell  1  (Punch  Press  Operation) 

Based  on  the  fault  tree  analysis,  the  probability  for  major  system  damage 
or  personal  injury  resulting  from  fire  and/or  explosion  in  Cell  1  of  the 
mechanical  removal  building  is  8.502  X  10“^  per  year.  The  major  categories  of 
accidents  and  their  contributions  to  the  above  accident  frequency  are  given 
beloWo 

•  impact  initiation  of  primer  tubes  due  to  mishandling  2 

outside  of  Cell  1  8.49  X  10  /yr 

•  initiation  of  primer  tubes  due  to  electrostatic  dis- 

charge  from  operator  9.10  X  10  /yr 

•  initiation  due  to  friction  generated  by  normal 

shearing  process  8.32  X  10  /yr 

For  the  purposes  of  the  analysis,  certain  judgements  were  made  concerning 
Cell  Ic  These  judgements  were: 

(a)  Cell  1  will  be  used  for  the  shearing  of  primer  tubes  into 
lengths  which  will  allow  their  deactivation  in  the  rotary 
furnaces  . 

(b)  Average  cycle  time  for  the  cell  is  15  min/cycle,  including  the 
time  required  for  loading  and  unloading  the  primer  tubes  onto 
the  carrier  plate. 

(c)  As  the  carrier  plate  has  not  yet  been  designed,  it  was 
necessary  to  make  certain  basic  assumptions  concerning  its 
design.  It  has  been  assumed  that  the  carrier  plate  will 
carry  25  primer  tubes  per  cycle,  held  by  a  "V"  notch  or 

some  similar  design  so  that  the  tubes  will  not  roll  together, 
or  be  pinched  flat  by  the  shearing  motion.  It  is  assumed 
some  sort  of  clamping  mechanism  will  hold  the  primer  tubes 
in  place. 

In  the  remainder  of  this  section,  the  specific  scenarios  from  the  above 
summary  will  be  described  in  detail. 

-2 

Impact  Initiations  Due  to  Mishandling  of  Primer  Tubes  (8.49  X  10  /yr) 

By  far  the  most  dominant  scenarios  in  the  Cell  1  fault  tree  analysis  were 
those  involving  the  mishandling  of  primer  tubes,  either  by  themselves  or  while 
in  Type  II  containers.  Scenarios  from  this  category  include  mishandling  inci¬ 
dents  which  take  place  during  transfer  of  primer  tubes  to  and  from  the  work 
area  of  Cell  1.  Included  are  incidents  involving  the  driverless  tractor  and 
forklift.  These  scenarios  are  described  in  order  of  descending  likelihood. 
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The  most  dominant  scenario  in  this  category  is  the  drop  of  a  primer  tube 
by  the  Cell  1  operator  while  loading  or  unloading  primer  tubes  from  the 
carrier  plate.  The  basic  components  and  failure  frequencies  are: 

Fault  Tree  Probability/ 

Component  No,  Description  Frequency  Used 


18 

Operator  loads/unloads  primer 
tube  from  carrier  plate 

200/hr 

19 

Operator  drops  primer  tube 

.001 

20 

Impact  initiates  primer  tube 

1.0  X  10 

21 

Operator  injured  by  fire/explosion 

loO 

-2 

This  scenario  has  a  frequency  of  8.32  X  10  per  year.  The  dominance  of 
this  scenario  is  due  primarily  to  the  high  frequency  with  which  this  operator 
must  handle  the  primer  tubes.  The  initiation  probability  is  based  on  an  extra¬ 
polation  of  impingement  data  for  lead  azide,  the  most  sensitive  to  impingement 
of  the  materials  likely  to  be  present  in  the  detonator  of  the  primer.  The 
threshold  initiation  level  of  25.1  m/sec  was  used  corresponding  to  an  initiation 
probability  of  0.05.  A  weight  of  1  Tb. (0.454kg  (for  the  primer  tube  was  used,  and 
a  drop  height  of  1  meter.  Given  the  inevitability  of  a  certain  number  of  mis- 
handlings  due  to  the  high  number  of  primer  tubes  handled,  it's  strongly  recom¬ 
mended  that  drop  tests  using  actual  primer  tubes  be  conducted  to  substantiate 
the  initiation  rate  used  above.  In  any  event,  use  of  conductive  pads  around 
the  v/ork  area  to  lessen  the  initiation  probability  may  be  advisable.  Also, 
it  is  highly  recommended  that  the  Cell  1  operator  be  provided  with  flame  resis¬ 
tant  clothing  and  gloves,  as  well  as  safety  glasses  and  full  face  shield. 

The  next  most  dominant  failure  mode  in  this  category  is  the  drop  by  the 
operator  of  a  Type  II  container  while  transferring  the  container  between  the 
pallet  of  containers  and  the  conveyor  area.  The  components  and  probabilities 
are  given  below. 
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Fault  Tree 
Component  No. 

Description 

Probabilities/ 
Frequency  Used 

14 

Operator  moves  Type  II  container 
between  pallet  and  work  area 

4/hr 

15 

Operator  drops  container 

.001 

1.0  X  10"^ 

16 

Impact  ignites  primer  tube 

17 

Operator  injured  by  fire/explosion 

1.0 

This  scenario 

_3 

has  a  failure  frequency  of  1.66  X  10 

per  year.  This 

is  similar  to  the  previous  one.  Although  the  primer  tubes  are  in  a  Type  II  con¬ 
tainer  which  will  dissipate  the  force  of  impact  somewhat,  there  are  more  tubes, 
estimated  at  50,  involved  in  a  single  drop.  These  factors  should  roughly  off-- 
set  and  the  same  probability  of  initiation  as  used  in  the  previous  scenario  is 
used  here. 


It  is  recommended  regarding  this  scenario,  and  others  to  follow,  that  drop 
tests  also  be  done  using  Type  II  containers.  Layers  of  padding  inside  the 
container,  somewhat  rigid  and  notched  to  resist  movement  of  the  primer  tubes 
within,  should  be  tested  for  effectiveness  in  cushioning  such  impacts. 

The  next  most  dominant  scenarios  in  this  category  concerns  the  mishandling 
of  a  pallet  of  14  Type  II  containers  containing  primer  tubes  during  a  transfer 

by  forklift  from  the  driverless  tractor  to  the  Cell  1  work  area.  In  this 
scenario  rough  handling  or  reckless  driving  causes  a  container  to  fall  off 


the  pallet  and  initiate. 

Component  No. 

Description 

Probability/ 
Frequency  Used 

9 

Forklift  transfers  pallet  between 
driverless  tractor  and  Cell  1  work 

.14/hr 

area 

11 

Container  is  dropped  due  to  forklift 
operator  error  (collision,  rough 
handling) 

.001 

ii 

10 

Impact  initiates  primer  tube  in 

Type  II  container 

1.0  X  10“^ 

-5 

The  failure  frequency  for  this  scenario  is  5.84  X  10  /yr.  Strict  control 
and  supervision  of  forklift  operation,  and  as  well  as  the  tests  recommended 
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for  the  previous  scenario,  are  recommended  to  minimize  the  probability  for  this 
scenario. 

The  next  scenario  is  similar  to  the  forklift  scenario,  but  concerns  the 
driverless  tractor. 


Fault  Tree 

Probability/ 

Component  No. 

Description 

Frequency  Used 

1 

Driverless  tractor  driven  manually 
during  approach/departure 

.14/hr 

2 

Operator  error  while  driving 

.001 

3 

Error  causes  jolt 

0.2 

4 

Jolt  causes  container  to  fall 

0.5 

from  pallet 

5 

Impact  results  in  initiation 

1.0  X  10  ^ 

The  failure  frequency  for  this  scenario  is  5.82  X  10  ^  per  year.  The 

recommendations  made 

in  the  forklift  section  are  also  relevant  here. 

Initiations  Due  to 

Electrostatic  Discharge  (9.10  X  10 

Vyear) 

This  category  is  represented  by  a  scenario  in  which 

failure  of  the 

operator  to  wear  proper  clothing  and/or  conductive  shoes 

results  in  an  electro- 

static  discharge  which  ignites  a  primer  tube.  The  components  and  probabilities 

are: 

Fault  Tree 

Probability/ 

Component  No. 

Descri ption 

Frequency  Used 

22 

Operator  begins  shift 

.125/hr 

26 

Operator  wears  improper  shoes/ 
clothing 

.001 

27 

Supervisor  does  not  stop  him 

.5 

28 

Other  workers  do  not  stop  him 

.7 

23 

Operator  carries  charge 

.05 

24 

Discharge  occurs  in  proximity 
to  exposed  explosive 

.01 

25 

Discharge  ignites  explosive  in 
primer  tube 

1,0 

The  failure  frequency  for  this  scenario  is  9.10  X  10  ESD  is  especially 
hazardous  while  handling  primer  tubes  because  of  the  explosive  exposed  through 
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perforations  on  tho  tubOj  and  black  powder  dust  present  on  the  carrier  tray 
as  a  result  of  the  shearing  operation.  Good  housekeeping  is  essential  here. 

It  is  strongly  recommended  that  a  device  be  installed  in  the  workers' locker 
room  on  which  they  must  step  for  a  check  for  conductivity  before  reporting  to 
their  work  stations.  Each  worker  can  be  required  to  sign  a  log  book  verifying 
he  has  performed  the  test.  This  process  will  also  serve  as  a  safety  reminder 
to  the  workers  immediately  before  reporting  to  work. 


Initiation  Due  to  Friction  Generated  by  Normal  Shearing  Process 

(8.32  X  10~^/year) 

During  most  shearing  operations,  the  lower  surface  of  the  shearing  tool 
is  not  perpendicular  to  the  direction  of  the  shearing  motion,  but  at  an  angle 

(see  fiqure  1).  This  results  in  a  component  of  the  resistinq  force  pushing  the 
shearing  tool  against  the  part  of  the  work  which  has  already  been  sheared.  The 
rubbing  induced  by  this  force  could  result  in  an  initiation  due  to  friction. 
This  scenario  can  take  place  during  the  course  of  the  normal  shearing  process, 
and  does  not  require  any  failure  to  occur.  The  components  and  probabilities 
for  this  scenario  are  listed  below. 


Fault  Tree 
Component  No. 

36 

37 


Description 

Primer  tubes  sheared  by  press 

Friction  generated  by  shearing 
results  in  initiation 


Probability/ 
Frequency  Use 


ZOCVhr 
1.0  X  10' 


■12 


The  expected  frequency  for  this  scenario  is  8.32  X  10  Although  the 

initiation  probability  per  shear  is  quite  low,  the  large  number  of  tubes 

sheared  result  in  a  significant  hazard.  The  analysis  was  based  on  a  shearing 

with  an  angle  of  30°,  a  shear  strength  for  the  steel  of  the  tube  of  50,000  psi , 

8  2 

and  a  speed  of  shear  of  l/4"/sec.  The  calculated  normal  force  is  4  X  10  N/m  . 
This  analysis  is  conservative.  It  is  strongly  recommended  that  primer  tubes 
with  simulants  be  instrumented  to  record  this  normal  force  and  run  through 
the  shearing  operation. 
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Figure  1. 


Normal  Shearing  Process 
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3.3.4  Large  Cell  C  (Unscrew  Machine) 

Results  of  the  fault  tree  analysis  of  the  Large  Cell  C  operations  indi- 

-3 

ate  a  category  I  or  II  accident  frequency  of  1.31  X  10  per  year,  excluding 
injuries  and  illnesses  of  various  causes.  In  the  analysts  of  Large  Cell  C, 
the  average  production  rate  was  taken  to  be  2.29  projectiles  per  hour.  The 
individual  rates  for  the  different  types  of  items  processed  in  Cell  C  were 
averaged  to  estimate  this  rate.  In  the  analysis,  items  were  assumed  to  be 
brought  by  truck  to  the  large  cells  and  carted  away  by  driverless  tractors. 

The  most  serious  incidents  considered  are  those  involving  explosion  and 
fire  because  of  the  high  potential  of  human  and  property  losses.  The  fault 
tree  analysis  has  shown  that  the  most  probable  are  those  involving  operator 
errors  with  forklifts,  operator  error  involving  monorail  crane  operation,  and 
operator  error  causing  fuze  impact  during  the  normal  defuzing  operation. 

These  particular  scenarios  are  discussed  below. 

Item  Impact  Initiation  due  to  Forklift  Operational  Errors  (3.49  X  10  ^/year^ 

Due  to  the  relatively  high  time  span  of  forklift  operations  the  potential 
for  items  mishandling  incidents  is  very  high  here.  One  particular  scenario  is 
that  of  an  operator  inadvertently  driving  a  forklift  into  items,  causing  an 
impact  sufficient  for  initiation.  This  particular  scenario  has  an  estimated 
frequency  of  3.49  X  10"'^  per  year„  It  is  described  on  the  summary  table  below. 


Fault  Tree 
Component  No. 

Description 

Probability/ 
Frequency  Used 

40 

Large  projectiles  being  loaded/ 
unloaded  at  large  cell 

2.54/hr 

41 

Forklift  used  for  unloading 

1.0 

43 

Forklift  used  near  items 

1.0 

44 

Forklift  inadvertently  driven 
into  items  due  to  operator  error 

0.003 

42 

Resultant  impact  is  sufficient 
for  initiation 

1.1  X  10"^ 
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Item  Drop  Impact  Initiation  During  Monorail  Operations  (3.14  X  10  /year) 

Another  incident  involving  item  initiation  due  to  hard  impact  is  that 
during  monorail  crane  operations,,  The  scenario  here  with  the  highest  fre- 
guency  of  occurrence  is  one  involving  human  error  with  the  use  of  the  crane 
controls,  causing  the  item  to  drop  during  crane  maneuvers.  This  particular 
incident  has  a  fre 

Fault  Tree 

Component  No. 

20 
21 
28 

22 

Fuze  Impact  Initiation  During  Manual  Defuzinq  Operation  (1.05  X  10  '/year, 

After  a  base  plate  is  removed  from  a  projectile,  the  base  fuze  must  be 
removed  manually.  This  is  done  by  first  cleaning  the  base  plate  and  fuze  of 
all  explosive  contamination  using  a  wooden  scraper  and  hot  water.  Then  the 
plate  is  secured  in  a  vise  and  the  fuze  is  removed  using  hand  tools.  If  the 
item  is  struck  or  scraped  with  the  wrong  type  of  tool  during  this  operation, 
fuze  initation  may  result.  Also,  if  the  item  is  dropped  during  these  manual 
procedures,  fuze  initiation  may  be  possible. 


-4 

quency  of  3.14  X  10  per  year 


Description 

Projectiles  being  prepared  at 
Large  Cell  A 

Monorail  used  to  transport  item 
to  Cell  C 

Item  is  dropped  during  crane 
maneuvers  due  to  operator  control 
failure  (human  error) 


Probability/ 
Frequency  Used 

1.0 

2.29/hr 

0.003 


Impact  is  sufficient  for  initiation  1*1  ^  ^0 


-4 


This  scenario 

is  summarized  below. 

Fault  Tree 
Component  No. 

Description 

Probability/ 
Frequency  Used 

116 

Item  in  defuzing  operation 

2.29/hr 

126 

Item  dropped  or  struck  during 
manual  fuze  removal 

0.001 

r 

127 

Resultant  impact  is  sufficient 
for  initiation 

1.1  X  10'^ 
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other  Potential  Hazards  in  Cell  C 

Other  hazards  of  concern  is  large  Cell  C  include  the  following: 

•  Since  all  of  the  large  projectiles  contain  Yellow  D,  there 
may  be  an  operator  exposure  problem,  particularly  during  the 
base  plate/fuze  cleaning  operations. 

f  Since  all  of  the  large  projectiles  weigh  from  105  to  2700  pounds, 
there  is  concern  for  operator  safety  in  all  phases  of  item 
transfer  operations. 
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3.3.5  Large  Band  Saw  (Large  Cell  B) 


The  fault  tree  analysis  of  the  large  band  saw  yielded  an  expected  fre¬ 
quency  of  2.17/year  of  major  system  damage  occurring.  The  primary  categories 
of  scenarios  producing  this  extremely  high  rate  are  summarized  below: 

•  Electrostatic  Discharge  from  Plastic  Sheet  used  to  Cover 
Sectioned  Item  (1.59/year) 

•  Initiation  During  Sawing  (0.198/year) 
t  Equipment  Damage  Scenarios  (0.17/year) 

•  Initiation  of  Full  or  Sectioned  Items  due  to  Mishandlings  (0.153/year) 

-  due  to  Forklift  operations  (0.132/year) 
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-  due  to  Impact  of  a  Sectioned  Item  (1.87  X  10  /year) 

-  due  to  Impact  of  a  Full  Item  (2=19  X  10"^/year) 
t  Initiation  due  to  a  Tool  Being  Dropped  onto  Contamination 

(5.24  X  10“^/year) 

•  Initiation  of  Contamination  While  Item  is  Lowered  onto  Saw 
Flatten  (8.27  X  10  ^/year) 

•  Operator  ESD  Initiation  (1.17  X  10”^/year) 

In  the  following  paragraphs  each  of  these  categories  of  scenarios  are  dis¬ 
cussed. 

Electrostatic  Discharge  from  Plastic  Sheet  Used  to  Cover  Sectioned  Item 

(1.59/year) 


It  is  the  current  intention  to  cover  sectioned  items  with  a  plastic  sheet 
to  minimize  the  possibility  of  contaminating  the  surrounding  area  during 
temporary  storage  or  transport.  In  reference  2  it  was  mentioned  that  this  is 
current  practice  at  Hawthorne  NAD.  Calculations  indicate  that  the  energy  pro¬ 
duced  in  a  single  discharge  from  a  dielectric  surface  of  this  type  would  be  on 
the  order  of  2.2  mj.  This  result  was  obtained  by  several  methods,  and  one  of 
the  approaches  is  presented  in  Appendix  E.  An  energy  of  2.2  mj  corresponds  to 
an  initiation  probability  of  about  3  X  10  ^  for  HBX-lo  Although  this  proba¬ 
bility  is  well  below  what  is  normally  considered  to  be  the  "threshold  level" 
the  5  percent  threshold  initiation  level  should  not  be  considered  tn  be  an 
absolute  lower  bound  for  the  possibility  for  initiation  to  occur.  This  over¬ 
all  scenario  involves  the  basic  events  described  below: 
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Fault  Tree  Probability/ 

Component  No.  Description  Frequency  Used 


182 

Sectioned  item  is  transported  to 

1.59/hr 

183 

work  point  B 

184 

Plastic  sheet  is  used  to  cover  exposed 
sectioned  item 

1.0 

185 

ESD  from  plastic  sheet  occurs  (dry  day)  0.8 

186 

Sectioned  item  is  initiated  due  to  ESD 

from  plastic  cover 

3  X  10" 

The  surface  of  the  item  may  be  moist  after  the  cutting  operation  due  to 
the  coolant,  and  this  will  reduce  the  immediate  charging  hazardo  However,  the 
item  will  then  be  stored  and  transported  with  the  plastic  cover  in  place.  It 
will  eventually  dry  off  and  the  plastic  could  develop  a  charge  then.  Therefore, 
it  is  strongly  recommended  that  untreated  plastic  covers  not  be  used  on  the 
sectioned  mineSo  Rather,  the  mines  should  be  covered  with  a  high  conductivity, 
low  permittivity  material,  for  example  conductive  plastic,  paper  or  treated 
cloth,  "Antistatic  agents  are  available  for  surface  or  bulk  treatments  of 
fabrics  or  plastics  which  depend  in  principle  on  capturing  surface  films  of 
moisture"  (ref.  3).  However,  such  treatments  are  temporary  at  best,  and  wear 
off  with  time.  Conductive  plastic  is,  therefore,  preferable. 

Initiation  During  Sawing  (0.198/year) 

The  probability  of  initiation  during  sawing  operations  was  derived  based 
on  the  data  available  in  reference  2  ,  Initiation  during  sawing  can  occur  by 
several  means.  The  relative  probabilistic  ranking  of  these  sawing  hazards  are: 

-2 

1.  Saw  force  and/or  speed  set  wrong  causing  initiation  (9.92  X  10  /year) 

2.  Initiation  due  to  saw  blade  breaking  due  to  misalignment 
(6o61  X  10"^/year) 

“2 

3.  Thermal  initiation  during  normal  sawing  (3.31  X  10  /year) 

4.  Initiation  due  to  loss  of  coolant  (3.98  X  10  /year) 

Based  on  the  hazards  analysis  presented  in  the  Batelle  report  (ref.  2  ) 
for  the  band  saw  operations,  the  probability  of  thermal  initiation  was  taken 
to  be  5  X  10“®,  the  "worst  case"  shown  for  sawing  with  coolant  present.  For 
loss  of  coolant,  the  "worst  case"  value  for  4  teeth  per  inch  cutting  without 
coolant  was  used,  1  X  10'^.  For  sawing  with  the  wrong  speed  and/or  force 
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setting,  a  probability  of  2.5  X  10  was  used,  corresponding  to  the  "worst 
case"  conditions  for  all  the  cases  considered  in  the  reference  2  study  except 
for  the  Rockeye.  The  Rockeye  was  estimated  to  have  a  thermal  initiation 
probability  of  1  in  all  cases  due  to  its  thin  wall.  A  lower  force  was  recom¬ 
mended  for  the  Rockeye  and  similar  items.  This  case  indicates  that  the  initia- 

_9 

tion  probability  may  be  higher  than  2o5  X  10  if  the  force  and/or  cutting 
speed  are  set  wrong. 

The  results  in  reference  2  for  cutting  through  contaminated  empty  items 
with  loose  internal  tubing  were  even  higher  in  some  cases,  up  to  0.12  for  the 
MK39  Mine.  In  these  cases,  cutting  through  loose  tubing  inside  the  item  would 
not  be  effectively  protected  by  a  coolant.  Therefore,  cutting  empty  contami¬ 
nated  items  will  be  significantly  more  likely  to  result  in  an  initiation  than 
cutting  full  items.  Naturally,  the  consequence  of  an  initiation  of  a  full 
item  is  significantly  worse  however. 

A  typical  scenario  in  this  category  is  presented  here: 

Fault  Tree  Probability/ 

Component  No.  Description  Frequency  Use 


304 

Item  is  brought  to  Cell  B  for 
sawi ng 

1.59/hr 

307 

Saw  force  is  set  wrong  (operator 
reads  settings  incorrectly) 

0.001 

308 

Blade  applies  too  much  force  for 
the  particular  item  being  cut 

0.1 

310 

Heat  buildup  is  not  dissipated  due 
to  type  of  item,  and  an  initiation 
resul ts 

2.5  X  10 

It  is  clear  that  the  sawing  operation  is  inherently  quite  hazardous.  Strict 
management  controls  must  be  enforced  to  insure  that  the  proper  force  and  saw 
speed  are  used  for  the  particular  item  to  be  cut.  If  a  contaminated  empty  item 
is  to  be  sawed,  the  initiation  probability  can  be  significantly  higher  than  for 
a  full  item  and  sawing  conditions  must  be  adjusted. 

Equipment  Damage  Scenarios  (0.17/year) 

A  variety  of  "non-fire  or  explosion"  scenarios  were  identified  in  which 
the  equipment  in  Cell  B  could  be  seriously  damaged.  These  scenarios  include  the 

NT  RESEARCH  INSTITUTE 


54 


band  saw  being  damaged  by  the  forklift  due  to  the  operator  being  careless 
or  inattentive,  an  item  falling  from  a  forklift  or  from  the  bridge  crane  onto 
the  band  saw,  or  being  swung  into  the  band  saw,  etc.  A  typical  scenario  in 
this  category  is  delineated  in  the  table  below: 


Fault  Tree 

Probability/ 

Component  No, 

Description 

Frequency  Used 

411 

Item  brought  inside  Cell  B  by 
Bridge  Crane 

1,59/hr 

414 

Operator  allows  hoisted  item  to 
ram  band  saw 

10“^ 

415 

Major  damage  to  band  saw  occurs 
(by  engineering  judgement) 

lO"-^ 

Initiation  of  an  Item  by  Forklift  Penetration  (1.32  X  lO'Vyear)  or 

_o 

Initiation  of  Sectioned  Item  by  Impact  (1.87  X  10  /year)  or  Initiation 
of  a  Full  Item  by  Impact  (2.19  X  10~^/year) 

The  next  three  categories  of  scenarios  are  similar  in  many  respects  and 
are  combined  in  this  section.  They  involve  an  error  or  control  failure  leading 
to  a  full  or  sectioned  item  being  mishandled.  Based  on  data  from  the  Vietnam 
war,  discussed  in  the  Priority  1  report,  a  finite  probability  has  been  derived 
for  initiation  of  items  by  impacts  due  to  mishandling  (e.g.  due  to  dropping  the 
item).  The  derived  initiation  probability  is  1.1  X  10  ^  per  trial.  It  is  con¬ 
sidered  that  a  sectioned  item  impacting  at  the  open  end  has  a  much  higher 
probability  of  initiation.  The  item  is  quite  heavy  and  would  ignite  contamina¬ 
tion  at  the  impact  point.  The  reaction  is  then  likely  to  propagate  to  the 
adjacent  explosive  exposed  at  the  cut  plane.  Similarly,  forklift  penetrations 
of  full  or  sectioned  items  are  considered  to  be  much  more  likely  to  cause 
initiation  due  to  the  hot  deformed  metal  coming  into  direct  contact  with  the 
explosive. 

Calculations  of  energy  required  to  penetrate  a  mine  or  bomb  (0.25  inch 
steel  wall)  indicate  that  penetration  could  occur  due  to  a  forklift  impact.  A 
geometry  effect  must  be  included,  however,  to  account  for  the  prong  hitting 
within  a  relatively  narrow  region  on  the  item.  Otherwise,  either  the  bomb  or 
the  prongs  will  move,  reducing  the  energy  available  for  penetration, 
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A  typical  item  initiation  scenario  is  delineated  below: 

Description 


Fault  Tree 
Component  No 


Probabil ity/ 
Frequency  Used 


87 

88 

89 

90 


Forklift  arrives  at  staging  area 
to  unload  item 


1.59/hr 

OoOOl 


Driver  misses  pallet  driving  too 
fast  (human  error  probability) 

Forklift  prong  impacts  and  penetrates  0.01* 
through  casing 

Penetration  stimulus  causes  initiation  1.0 


*  Geometry  factor  for  location  of  hit  and  factor  for  speed  being  high 
enough  to  cause  penetration 

_2 

Impact  Initiation  of  Contamination  by  Tool  Being  Dropped  (5.24  X  10  /year) 

The  primary  scenario  involving  local  impact  initiation  due  to  an  operator 
dropping  a  tool  onto  contamination  was  found  to  occur  during  servicing  of  the 


filter  mediao  In  this 

case  an  operator  is  injured  due  to  . 

a  flash  fire  occur 

ring,  and  significant 

damage  to  equipment  does  not  occur. 

Fault  Tree 

Probability/ 

Component  No. 

Description 

Frequency  Used 

393 

Operator  enters  cell  to  service 
filter  media  (once  every  40  hours) 

2.52  X  10"^/hr 

394 

Operator  allows  contamination  to 

0.5 

fall  on  floor  while  pulling  filter 
media  out  of  container 

o 

395 

Operator  drops  tool  on  contamination  10 

396 

Impact  stimulus  initiates  contami¬ 
nation  (sensitivity  data  for  dry 

1.0 

HBX-1  Used) 

397 

Flash  fire  results,  i.e.  fire 
propagates  to  filter  media  and 
contami nation 

0.1 

398 

Operator  is  severely  burned  due  to 
flash  fire 

1.0 
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Item  Initiates  Contamination  While  Being  Lowered  onto  the  Platten 

(8.27  X  I0~^/year) 

If  the  saw  platten  is  not  cleaned  between  operations,  a  mixture  of  explo¬ 
sive  and  metal  chips  will  be  impacted  or  pinched  each  time  an  item  is  lowered 
onto  the  platten.  If  this  contamination  is  wet  from  coolant,  the  material  is 
not  expected  to  be  easily  ignited.  However,  some  fraction  of  the  time  the 
explosive  will  be  allowed  to  dry  somewhat.  Although  probit  impact  sensitivity 
data  is  not  available  for  such  moist  materials,  initiation  is  expected  to  be 
likely  in  this  case.  Then  propagation  of  the  reaction  into  a  sectioned  item 
could  produce  an  explosion 


Fault  Tree 
Component  No, 


Description 


Probability 
Frequency  Used 


399 

Large  cell  is  not  cleaned  of  explosive 
particles  after  sectioning  of  each  item 
(human  error  probability) 

0.001 

400 

Explosive  particles  accumulate 

1.0 

401 

Items  are  brought  to  Cell  B  for 
sectioning  and  sectioning  is  accomplished 

1.59/hr 

406 

Sectioned  item  is  hoisted  up  off  saw 
pi  atten 

1.0 

407 

Item  is  lowered  back  onto  saw  platten* 

0.05 

408 

Lip  of  sectioned  item  impacts  explosive 
contamination 

0.5* 

409 

Initiation  of  contamination  ignites 
exposed  explosive  of  sectioned  item 

0.05  ** 

410 

Fire  or  explosion  results 

1.0 

end  will 
low  end 

be  slightly  lower  than  the  other.  There  is  a 
is  the  one  with  exposed  explosive. 

50%  chance  that 

**  The  impact  stimulus  is  estimated  to  be  1.51  X  10  ^  j/m  .  This  corresponds 
to  a  probability  of  1  for  dry  explosive.  A  factor  of  0.05  is  added  to 
account  for  the  fraction  of  time  that  the  contamination  is  relatively  dry. 
The  resultant  reaction  would  be  very  near  the  exposed  explosive  in  the 
sectioned  item  and  propagation  is  likely. 

Electrostatic  Discharge  Initiation  from  an  Ungrounded  Operator 

(1.17  X  10~Vyear) 

The  scenario  in  which  an  operator  wears  ungrounded  shoes  into  the  area  has 
shown  up  for  much  of  the  rest  of  the  WADF  system.  In  this  case,  the  computed 
probability  of  1.17  X  10~Vyear  may  be  somewhat  conservative  in  that  the  filter 


57 


media  is  generally  wet,  whereas  sensitivity  data  for  dry  HBX-1  was  used  in  the 
calculation.  It  should  be  noted,  however,  that  there  will  be  times  when  the 
filter  media  is  serviced  after  it  has  had  a  chance  to  dry. 


Fault  Tree 
Component  No. 


Description 


Probability 
Frequency  Used 


384 

Operator  enters  cell  to  service 
filter  media 

2.5  X 

385 

Operator  is  not  wearing  grounded  shoes 

0.001 

386 

The  supervisor  or  other  personnel  do 
not  stop  him 

0.35 

387 

Operator  walks  across  floor  and  becomes 
charged  (dry  day) 

0o8 

388 

Operator  discharges  to  filter  media 
container  (layout  of  area  and  job  to 
be  done) 

0,1 

390 

BSD  has  sufficient  energy  to  initiate 
explosive  on  the  filter  (sensitivity 
for  dry  HBX-1 ) 

0,02 

391 

Flash  fire  results 

1,0 

392 

Operator  is  severely  burned 

1,0 

^-2 


/hr 
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4.  RECOMMENDATIONS  AND  CONCLUSIONS 


In  this  section,  the  recommendations  and  conclusions  resulting  from  the 
Priority  2  hazards  analyses  are  consolidated.  They  are  presented  for  each  area 
of  the  facility  that  was  evaluated  under  Priority  2  and  have  been  prioritized 
using  descriptive  terms  such  as  (in  decreasing  order  of  urgency)  "strongly 
recommended",  "recommended",  "suggested/good  practice",  and  "concluded". 

General  recommendations  that  apply  to  more  than  one  area  are  presented 
separately  at  the  end  of  the  section. 

4ol  PREPARATION  BUILDING 

•  It  is  recommended  that  cartridge  cases  to  be  processed  in  the 
preparation  bui  laing  be  tested  to  determine  if  a  flammable 
mixture  of  volatile  vapors  with  air  is  present  in  the  void 
spaces  in  the  case.  Naturally,  this  is  only  relevant  for  cases 
containing  propellant  that  was  manufactured  by  a  solvent  process. 
Analyses  conducted  in  this  study  indicated  that  a  flantnable  mix¬ 
ture  may  be  present,  but  there  were  significant  uncertainities 

in  the  analyses  to  determine  this  for  sure.  Therefore,  an  ex¬ 
perimental  solution  is  warranted.  A  gas  sample  can  be  extracted 
from  a  closed  cartridge  case  by  drilling  a  small  hole  into  the 
case,  or  a  flammable  gas  detector  can  be  used  to  monitor  the 
gas  while  cases  are  opened.  In  both  tests  precautions  must  be 
exercised  to  prevent  and  guard  against  an  ignition  of  the  gases 
or  propellant  in  the  case.  If  uncertainty  remains  even  after 
such  testing,  it  is  recommended  that  a  flammable  gas  detector 
be  installed  in  the  vicinity  of  the  case  cutter  and  pull  apart 
machines  to  warn  operators  of  the  presence  of  a  flammable  gas 
during  the  operation  of  Cell  5. 

•  It  is  imperative  that  a  water  cushion  be  present  at  all  times 

for  fuzes  dropped  into  the  "fuze  drop"  tanks  in  Cells  3  and  6.  ■ 

It  is  possible  that  the  operators  will  allow  this  tank  to  ^  , 

become  empty  (no  water)  or  to  become  overfilled  with  fuzes. 

In  either  case,  a  finite  probability  exists  for  initiation 
of  the  fuzes  by  impact.  Therefore,  it  is  recommended  that  a 
sensor  be  installed  to  warn  the  operators  of  insufficient 
water  at  the  start  of  an  operation  and  of  too  many  fuzes  during 
the  operation.  This  could  be  accomplished  by  sensing  the  weight 
of  the  tank.  Prior  to  operation,  the  weight  must  be  at  least 
that  of  a  water  filled  container  or  the  operation  cannot  begin 
by  interlock.  During  operation,  if  the  weight  exceeds  the  level 
at  v/hich  fuzes  are  no  longer  protected  by  a  significant  layer 
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of  water,  a  warning  should  be  actuated.  Alternate  solutions 
to  this  problem  should  be  evaluated. 


•  Preparation  Building,  Cell  1,  is  now  earmarked  for  storage  of 
"unsafe"  items  until  enough  of  them  accumulate  to  be  taken  to 
the  disposal  site".  This  is  a  blatantly  unsafe  practice  and  it 

is  recommended  that  it  not  be  done.  Should  an  "unsafe"  or  "suspect" 
round  or  item  be  detected,  its  disposal — or  at  the  very  least, 
its  removal  from  a  busy  operating  building — should  be  immediate, 
and  under  strict  control.  To  do  any  less  than  this  would  be  a 
highly  unsafe  act.  Removal,  after  all,  should  pose  no  major 
hardship.  Based  on  the  combined  assumed  throughput  rates  of 
cell  3,  and  cells  4-5-6,  and  the  1  per  1000  "suspect"  item  inci¬ 
dence  projected,  we're  only  talking  about  3  per  day. 

•  It  is  anticipated  that  the  robot  manipulators  will  require 
frequent  preventive  maintenance  to  minimize  the  possibility 
of  mechanical  or  control  failures  that  can  result  in  impacts 
causing  equipment  damage  and/or  initiation  of  munitions  items 
being  handled. 

t  It  is  recommended  that  partitions  be  constructed  to  better 

isolate  the  different  individual  work  stations  in  the  l^reparation 
Building  corridor,  receiving  area,  and  distribution  area.  Cur¬ 
rently,  if  an  incident  occurs  which  causes  a  round  or  item  to 
fire  or  detonate,  personnel  at  other  work  stations  are  in  a 
direct  path  for  serious  injury  by  blast,  fragments  or  an  acci¬ 
dentally  launched  projectile.  Isolating  personnel  to  the  extent 
practical  with  partitions  will  at  least  increase  their  protection 
against  fragments  and  projectiles. 

•  For  the  various  unscrewing  operations  in  the  Preparation  V 

Building  and  elsewhere,  it  is  suggested  that  consideration 

be  given  to  spraying  the  threaded  areas  with  a  compatible 
penetrating  lubricant  before  attempting  to  unscrew  the  parts. 

This  could  improve  the  safety  of  the  operation  by  wetting  any 
trace  contaminants  which  may  be  present,  and  by  minimizing  i 
the  force  required  to  loosen  the  stuck  threads. 


4.2  ACCUMULATOR  SYSTEM 

•  It  is  recommended  that  the  rubber  boots  inside  the  pinch  valves 
in  the  accumulator  building  be  periodically  inspected  for  wear 
rf  that  could  lead  to  a  major  leak.  The  rubber  boots  or  pinch 

f<*  valves  should  be  repaired  or  replaced  if  such  wear  is  observed. 

A  large  leak  in  the  rubber  boot  could  lead  to  impingement 
initiation  of  small  propellant  grains  being  processed. 
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•  Bearing  failure  in  the  smokeless  powder  conveyor  can  result 

in  a  fire  due  to  frictional  heating  at  a  stuck  roller  or  due  ol 
to  a  bearing  overheatingo  It  is  recommended  that  the  roller 
bearings  in  the  smokeless  powder  conveyor  be  inspected  and 
maintained  frequently.  A  conservative  inspection/maintenance 
aid  part  replacement  schedule  should  be  established  based  on 
the  manufacturers  reliability  data  for  the  bearings  in  use. 

With  regard  to  overheated  bearings,  periodic  infrared  photo¬ 
graphs  during  the  operation  or  strategically  placed  infrared 
sensor  might  be  useful  to  sense  the  onset  of  the  bearing  failure 

•  Care  should  be  taken  during  the  setup  of  the  rubber  receiving 
hopper  to  assure  that  it  does  not  push  too  tightly  against  the 
moving  conveyor  belto  Calculations  indicated  that  a  nominal 
force  (10  lb)  could  result  in  a  significant  temperature  rise 
at  the  interface. 

•  Whenever  a  powder  or  granular  material  is  emptied  from  one 
vessel  or  hopper  into  another  container,  the  possibility 
exists  that  a  significant  voltage  difference  will  develop 
between  the  two  containers  due  to  electrostatic  charging.  If 
the  voltage  difference  is  high  enough,  a  discharge  can  occur 
between  the  containers  or  to  another  object,  for  example  to 

an  operator.  Such  a  discharge  could  ignite  the  material  being 
transferred.  Therefore,  it  is  strongly  recommended  that  posi¬ 
tive  electrical  bonding  be  assured  between  the  weigh  hopper 
and  the  Type  III  or  MKIV  container  being  filled  in  the  accumu¬ 
lator  system,  as  well  as  between  the  various  dust  collector  and 
vacuum  system  hoppers  and  the  Type  III  container  used  during 
system  emptying  operations o  A  reasonable  assurance  of  bonding 
can  be  achieved  by  placing  the  Type  III  or  MKIV  container  onto 
a  conductive  rubber  covered  metal  platform  (or  the  roller  con¬ 
veyor  in  the  case  of  the  filling  operation)  that  is  permanently 
bonded  to  the  equipment  item  being  emptied.  The  platform  must 
be  kept  clean  or  its  effectiveness  will  be  lost.  In  addition, 
a  separate  bonding  strap  should  be  manually  connected  between 
the  hopper  being  emptied  and  the  container  being  filled.  This 
redundancy  affords  some  degree  of  assurance  that  bonding  will 
be  achieved  only  as  long  as  the  electrical  contacts  are  clean 
and  secure. 


•  The  dust  collector  and  vacuum  system  ducts  should  be  inspected 
and  cleaned  frequently  to  avoid  any  significant  buildup  of  a 
propellant  dust  layer  inside  the  ducts o  Periodically  flushing 
out  (Oog.  with  hot  water)  should  be  considered  to  minimize  the 
buildup.  Materials  handled  by  the  dust  collector  and  vacuum 
systems  should  be  checked  to  assure  compatability  at  the  tempera 
tures  to  which  they  will  be  exposed  inside  the  ducts. 
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Preparation  Building,  Cell  5,  and  the  Accumulator  Building, 
together,  present  a  unique  problem,  viz.,  segregation  and  control 
of  "dissimilar"  propellants.  Propellants  dumped  in  Cell  5,  are 
to  be  conveyed  to  the  Accumulator  Building  for  packaging"...  for 
storage  or  for  sale".  Care  must  be  taken  in  both  locations, 
therefore,  to  prevent  uncontrolled  mixing  of  different  propellant 
types.  Each  propellant  formulation  must  be  separately  and 
individually  packaged  because  mixing  —  although  not  hazardous 
per  se — would  pose  a  serious  problem  or  threat  to  a  buyer,  in 
the  event  of  sale.  Processing  methods  for  reclamation  or  reuse 
of  double-  or  triple-base  propellants  (eg.,  M26  or  M30)  are 
much  different  than  those  for  single-base  (eg..  Ml,  M6,  or 
BS-NACO).  To  mix  them  together  would  cause  an  intollerable, 
and  potentially  hazardous,  problem  in  certain  cases.  For 
example,  introduction  of  NG  into  a  process  designed  to  recover 
NC  from  single-base  propellants  would  create  a  real  safety  hazard. 
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4.3  MECHANICAL  REMOVAL  BUILDING 


The  analyses  of  the  mechanical  removal  building  included  the  punch  press 
operation  (Cell  1),  the  small  band  saw  operation  (Cell  2),  and  the  hole  sawing 
operation  (Cell  3). 


4.3.1  Punch  Press  Operation  (Cell  1) 


The  hazards  analysis  of  the  punch  press  operation  was  based  on  the  assump¬ 


tion  that  long  primer  tubes  will  be  segmented  in  Cell  1.  If  primer  tubes 
to  be  processed  in  Cell  1,  the  following  recommendations  are  provided: 

•  It  is  recommended  that  drop  tests  be  carried  out  on  primer  tubes 
in  order  to  accurately  determine  their  response  to  this 
stimulus.  Should  such  tests  show  a  significant  probability 

of  initiation,  it  is  strongly  recommended  that  additional  tests 
be  carried  out  to  determine  the  response  of  primer  tubes  enclosed 
in  a  Type  II  container  to  impact,  and  to  test  various  methods  of 
cushioning  within  the  container  to  prevent  such  initiations. 

•  It  is  strongly  recommended  that  primer  tubes  be  instrumented 
and  subjected  to  the  shearing  operation  to  determine  functional 
forces  which  arise  during  the  shearing  operation.  Small  amounts 
of  black  powder  may  be  included  in  these  tests  to  determine 
characteristic  response  data. 

•  These  tests  should  be  done  prior  to  the  startup  of  the  Cell  1 
operation.  If  initiation  is  likely,  the  extent  of  damage  to 
the  cell  due  to  an  individual  primer  tube  being  ignited  and 
due  to  a  Type  II  container  filled  with  primer  tubes  being 
initiated  should  be  evaluated  based  on  simulation  testing,  it 
is  conceiveable  that  the  consequence  of  an  initiation,  e.g. 
during  shearing,  can  be  tolerated  in  this  case. 
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4.3.2  Small  Band  Saw  Operation  (Cell  2) 


•  The  small  and  large  band  saw  operations  are  quite  similar  in 
many  respects.  Therefore,  many  of  the  recommendations  made 
for  the  large  band  saw  apply  here  also  (see  Section  4.4.2) 

•  In  the  small  band  saw  operation,  the  "head"  of  the  item  will 
either  fall  into  a  tray,  or  be  thrown  after  sawing  is  completed. 
In  either  case,  the  initiation  of  a  significant  amount  of 

■f  explosive  in  the  head  (about  one  pound)  is  expected.  Sympathetic 
detonation  of  the  three  depth  charges  in  the  fixture  could  also 
occur,  resulting  in  major  system  damage.  It  is  strongly  recom- 
mended  that  the  fixture  and  carrier  plate  be  redesigned  so  that 
the  "head"  of  the  item  is  secured  and  does  not  fall  freely  after 
sawing. 


4.3.3.  Hole  Sawing  Operations  (Cell  3) 

It  is  strongly  recommended  that  a  conservative  inspection  c) 

and  replacement  schedule  be  developed  for  the  cutters  to  be 
used  in  Cell  3.  It  is  expected  that  these  cutters  will  gen¬ 
erally  have  a  short  life  span  and  will  require  frequent  re¬ 
placement.  A  dull  or  broken  cutter  can  result  in  initiation 
inside  a  munitions  item  being  processed  in  the  cell. 

It  is  strongly  recommended  that  operating  parameters  be  ‘  ' 

derived  for  the  hole  sawing  operation,  such  as  was  accomp- 
lished  for  band  saws  and  hacksav^s  in  reference  2.  It  is 
expected  that  criteria  for  teeth  per  inch,  cutting  force 
and  cutting  speed  must  be  carefully  defined  for  each  item 
to  be  processed  to  minimize  the  probability  of  initiation 
during  cutting. 

•  It  should  be  noted  that  the  most  hazardous  condition  during 

hole  sawing  will  be  cases  where  the  hole  is  not  positioned  j  / 

correctly  and  loose  internal  plumbing  is  sawed  into  (by 
analogy  with  the  band  saw  results  presented  in  reference  2). 

In  these  cases,  increased  frictional  heating  occurs  due  to 
cocking  of  the  loose  internal  part,  while  exposure  to  coolant 
is  restricted.  In  addition,  relatively  large  quantities  of 
explosive  could  remain  hidden  behind  the  internal  plumbing 
and  become  ignited. 


§ 


4„4  LARGE  CELLS 

The  two  active  operations  in  the  Large  Cell  area  were  analyzed  for  poten¬ 
tial  hazards.  These  were  the  unscrew  machine  (Cell  C),  and  the  large  band  saw 
(Cell  B)o  Cell  A  is  presently  empty  and  did  not  require  a  hazards  analysis. 
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4.4.1  Unscrew  Machine  (Cell  C) 


•  The  manual  removal  of  the  base  fuze  and  associated  cleaning  of  the 
base  plate  and  fuze  are  considered  to  be  inherently  hazardous 
operations.  If  the  item  is  struck  or  scraped  with  the  wrong  type 
of  tool,  fuze  initiation  may  result.  In  addition,  the  items  are 
filled  with  highly  toxic  yellow  D,  and  the  operator  could  be 
exposed  to  this  chemical. 


4.4,2  Large  Band  Saw  (Cell  B) 


•  It  is  strongly  recommended  that  an  untreated  nonconductive 
plastic  sheet  not  be  used  to  cover  items  sectioned  at  Cell  B. 
Rather,  the  sectioned  items  should  be  covered  with  a  relatively 
high  conductivity,  low  permittivity  material,  for  example  con¬ 
ductive  plastic,  paper  or  treated  cloth.  Otherwise,  an  electro¬ 
static  discharge  from  the  plastic  sheet  has  a  finite  probability 
to  initiate  the  exposed  explosive. 


•  The  sawing  operation  is  inherently  hazardous.  Strict  manage- 
ment  controls  must  be  enforced  to  insure  that  the  proper  force 
and  saw  cutting  speed  are  used  for  the  particular  item  to  be 
cuto  If  a  contaminated  empty  item  is  to  be  sawed,  the  initia¬ 
tion  probability  can  be  significantly  higher  than  for  a  full 
item  (from  reference  2  analysis)  and  the  sawing  conditions 
must  be  adjusted  to  account  for  this.  While  sawing  contaminated 
empty  items  internal  plumbing  should  be  avoided,  because  this 
is  where  thermal  initiation  is  most  likely. 


4.5  GENERAL  RECOMMENDATIONS  FOR  THE  PRIORITY  2  SYSTEMS 

Many  of  the  general  recommendations  presented  for  the  Priority  1  Systems 
are  pertinent  here  also.  These  recommendations  are  repeated  below: 

•  Every  operation  on  every  equipment  item  must  be  covered  by  a 
written  procedure,  reviewed  and  approved  by  operating  and 
safety  management  personnel . 

•  A  comprehensive  training  program  should  be  required  for  all 
plant  personnel,  including  information  on  potential  hazards. 

•  All  equipment  operators  should  be  given  appropriate  training 
courses  and  certified  or  licensed  for  operations  in  which  they 
will  be  involved. 

•  All  plant  personnel  should  be  tested  for  electrical  grounding 
of  footgear  at  least  once  a  day  with  a  sign-in  sheet. 
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•  Frequent  cleanup  of  each  plant  area  is  mandatory  to  prevent 
buildup  of  contamination.  Such  cleanups  should  be  scheduled 
as  part  of  the  operating  procedures  for  each  area. 

t  Area  surfaces  should  be  kept  wet  during  maintenance  as  part 
of  the  procedure.  The  equipment  should  be  thoroughly  cleaned/ 
decontaminated  prior  to  any  maintenance  operation. 

•  It  is  recommended  that  a  2  locker  system  be  adopted  for  plant 
personnels One  locker  should  be  for  street  clothes  and  a 
second  locker  for  work  clothes.  All  clothing  should  be  changed 
at  the  beginning  and  end  of  the  shift.  Clothing  should  be 
supplied  by  the  plant  -  nothing  taken  home.  A  shower  should 

be  taken  enroute  from  taking  off  work  clothes  to  putting  on 
street  clothes.  This  procedure  will  also  help  avoid  street 
shoes  being  mistakenly  worn  in  the  plant  areas. 

•  An  area  entry  and  hot  work  permit  program  should  be  set  up 

to  assure  that  all  temporary  repairs  and  maintenance  operations 
are  well  thought  out  and  accomplished  with  several  levels  of 
management  checks. 

•  During  maintenance,  tools  should  be  connected  to  the  workmen 
by  a  cord  wherever  practical  to  help  break  the  fall  of  the 
tool  if  it  is  dropped. 

•  Strict  cleanliness  must  be  enforced  at  all  times  in  the  plant, 
particularly  when  personnel  leave  contaminated  areas  to  go  to 
lunch  or  at  the  end  of  the  shift.  Nothing  should  be  eaten  in 
the  work  area.  No  food  should  be  allowed  in  the  work  area. 

•  A  medical  surveillance  program  should  be  set  up  to  screen 
personnel  for  specific  jobs  at  hiring  and  to  assure  that  long 
term  health  damage  is  avoided. 

§  Any  major  system  modifications  made  in  the  future  should  be 
safety  analyzed  upon  completion  of  their  design. 
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APPENDIX  A 


HAZARDS  ANALYSIS  APPROACH 
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APPENDIX  A  HAZARDS  ANALYSIS  APPROACH 


Basically,  the  following  steps  were  used  in  the  analyses: 

a)  Collect  Available  Information 

b)  Review  Information/Learn  System 

c)  Conduct  an  Informal  Failure  Modes  and  Effects  Analysis  (FMEA) 

d)  Develop  Fault  Tree  Logic  Diagrams  for  System  (FTA) 

e)  Quantify  Fault  Tree  (derive  scenario  probabilities) 

f)  Interpret  and  Summarize  the  FTA  Results 

For  the  purposes  of  this  program,  the  failure  modes  and  effects  analyses  served 
to  identify  types  of  consequences  and  types  of  scenarios  to  be  expected  in 
different  areas  of  the  WADF.  The  FMEA's  were  used  to  learn  the  system  and  guide 
the  development  of  the  fault  trees.  Fault  tree  analysis  was  the  primary 
methodology  used  to  identify  and  quantify  credible  hazards  at  the  facility. 

The  FMEA  and  Fault  Tree  methods  are  described  below: 

A.l.  FAILURE  MODES  AND  EFFECTS  ANALYSIS  (FMEA) 

Failure  Modes  and  Effects  Analysis  is  a  relatively  simple  and  direct 
approach  for  identifying  basic  sources  of  failure  and  their  consequences.  This 
method  is  not  rigid  and  can  be  used  for  widely  differing  applications.  It  is 
especially  applicable  for  identifying  sources  of  malfunctions  in  hardware 
systems  or  in  process  equipment.  The  primary  purpose  of  the  analysis  is  to 
identify  and  remove  failures  that  can  cause  hazards.  However,  as  a  side 
benefit,  the  analysis  also  leads  to  the  identification  of  failures  that  are 
in  themselves  not  hazardous  but  might  affect  the  reliability  of  the  functioning 
of  a  system.  The  results  of  such  an  analysis  also  may  serve  as  an  input  to 
a  Fault  Tree  Analysis,  although  more  generally  the  two  methods  are  used 
independently. 

A  Failure  Modes  and  Effects  Analysis  is  carried  out  by  filling  in  a  table 
having  column  headings  such  as  the  ones  shown  in  Figure  A1 .  This  format  is 
the  one  used  for  the  Priority  1  systems.  The  first  two  columns  list  the 
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system  parts  and  procedure  steps  obtained  from  the  available  drawings,  written 
descriptions,  etc.  The  third  column  is  used  to  identify  the  different  possible 
failure  modes  for  each  entry  listed  in  the  previous  columns.  There  may  be 
several  entries  in  column  3  for  each  system  part  or  task.  Given  these  initial 
failures,  the  possible  chains  of  events  were  described  in  the  next  column, 
and  the  ultimate  effect  on  the  system  was  given  in  the  last  column.  The 
Priority  1  FMEA  tables  were  relatively  formal  and  time  consuming  to  produce. 
These  tables  were  used  primarily  as  "shopping  lists"  for  fault  tree  development, 
a  function  not  necessitating  the  formal  presentation.  In  Priority  2  and  3 
analyses  a  less  formal  FMEA  presentation  is  being  utilized,  although  this  method 
is  still  used  to  provide  the  basis  for  fault  tree  diaoramminq, 

A.  2.  FAULT  TREE  ANALYSIS 

A  powerful  method  that  has  developed  rapidly  since  1962  is  the  Fault  Tree 
Analysis.  This  method  may  be  viewed  as  a  systematic  and  comprehensive  investi¬ 
gation  of  a  postulated  accident  before  it  occurs.  The  term  "accident"  in  this 
case  is  used  to  signify  any  kind  of  undesired  event.  The  procedure  is  to 
define  this  undesired  event  and  to  identify  all  immediate  causes  that  could 
have  brought  it  about.  These  causes,  in  turn,  are  traced  back  through  the 
system  until  one  arrives  at  the  ultimate  causes  that  initiated  the  sequence  of 
events  that  led  to  the  undesired  event.  These  ultimate  causes  may  be  failures 
of  individual  hardware  components,  or  human  errors,  or  other  factors  which 
either  singly  or  in  combination  could  have  initiated  the  hazardous  action. 

An  immediate  result  of  such  an  analysis  is  a  highly  visible  graphical 
representation  of  all  basic  failures  and  the  paths  whereby  they  can  combine 
to  create  the  undesired  event.  The  method  also  can  be  used  quantitatively. 

If  data  are  available  for  the  probability  of  occurrence  of  the  basic  failures, 
it  is  possible  to  calculate  the  probability  of  occurrence  of  the  undesired 
event.  In  doing  so  it  is  also  possible  to  identify  those  basic  failures  that 
are  most  critical,  and  the  most  critical  sets  of  events  (scenarios),  so 
priorities  can  be  established  for  taking  corrective  action. 

An  analysis  begins  by  identifying  an  Undesired  Event  whose  causes  are  to 
be  traced.  Graphically,  this  event  is  placed  at  the  top  of  the  page  and 
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represents  the  base  of  a  tree  whose  branches  are  developed  and  extend  down¬ 
ward.  Once  the  undesired  event,  also  called  a  Top  Event  is  specified,  it  is 
necessary  to  identify  the  immediate  causes  which  directly  could  cause  this  top 
event.  Each  of  these  causative  events,  in  turn,  is  further  broken  down  into 
subordinate  events. 

This  process  is  continued  until  one  arrives  at  basic  input  events  that 
cannot  be  broken  down  further,  or  for  which  probability  data  are  available 
so  there  is  no  need  to  go  further.  This  process  creates  a  diagram  which 
resembles  a  tree  whose  branches  extend  and  spread  out  downward,  with  each 
branch  terminating  in  basic  input  events. 

Figure  A2  illustrates  the  diagrammatic  arrangement  of  a  fault  tree,  and 
Figure  A3  identifies  the  goemetric  symbolism  that  is  commonly  used  in  fault 
tree  construction.  It  is  to  be  noted  that  a  fault  tree  consists  of  three 
essential  elements  —  input  events,  logic  gates,  and  output  events.  The  basic 
logic  gates  are  of  two  kinds,  namely  OR  gates  and  AND  gates.  If  an  output 
event  can  be  caused  by  one  or  more  input  events,  either  when  each  acts  by 
itself,  or  when  they  act  together,  these  input  events  pass  through  an  OR 
gate.  On  the  other  hand,  if  an  output  event  can  be  caused  only  when  all  input 
events  must  act  in  combination,  these  input  events  pass  through  an  AND  gate. 

This  concept  is  illustrated  in  Figure  A4  where  the  top  event  is  defined 
as  the  lighting  of  the  light  bulb.  For  the  circuit  diagram  which  shows  all 
the  switches  arranged  in  series,  all  four  must  be  closed  for  the  light  to  stay 
lit.  In  the  logic  diagram  for  this  arrangement,  these  three  switches  are 
shown  connected  to  an  AND  gate.  In  the  other  circuit  diagram,  where  the  four 
switches  are  arranged  in  parallel,  it  is  evident  that  the  closing  of  any  one 
switch  would  be  sufficient  to  light  the  bulb.  The  logic  diagram  for  this  case 
shows  the  four  input  events  to  pass  through  an  OR  gate.  If  the  probability 
for  each  of  the  switches  A,  B,  C,  and  D  remaining  closed  were  known,  it  would  be 
possible  to  determine  the  probability  of  the  bulb  remaining  lit  for  each  circuit. 
That  is,  the  symbolic  logic  relationships  can  be  converted  to  algegraic  ex¬ 
pressions  for  numerical  calculation. 
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Undesired 

Event 


AND  Logic  Gate 


Priority 

) 

V. 

J 

An  evenc  caused  by  one  or  more  other  events 
which  are  identified 


A  basic  input  event  that  does  not  require 
further  development  as  to  causes 


An  event  which  is  not  developed  further  as 
to  its  causes  because  of  lack  of  inforination 
or  significance 


An  event  which  is  normal  for  the  system; 
not  a  fault  or  failure  per  se 


AND  gate  -  output  event  occurs  only  if  all 
the  input  events  are  present 


OR  gate  -  output  event  occurs  when  one  or 
more  of  the  input  events  are  present 


INHIBIT  gate  -  output  event  is  caused  by^ 
input  event  only  if  specified  condition  is 
satisfied 


Attached  to  logic  gate  to  specify  a  condition 


A 

V 


Continuation  symbol  to  identical  portion 
of  fault  tree 

A  Transfer  In 


^  Transfer  Out 

Continuation  symbol  to  similar  (but  not 
identical)  portion  of  fault  tree 


^  Transfer  In 


^  Transfer  Out 

Figure  A3  Symbols  Used  in  Fault  Tree  Cr.nr.tructinn 
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Circuit  Analogy 


And  Gate  Logic 
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Circuit  Analogy 


Or  Gate  Logic 


A-7 


A. 3  QUANTIFICATION 

IITRI  has  a  fault  tree  analysis  computer  program  for  evaluating  the  fault 
tree  diagrams.  The  first  portion  of  the  computer  code  uses  a  matrix  approach 
known  as  the  Boolean  Indicated  Cut  Set  (BIC)  method  to  reduce  the  tree  logic 
to  a  list  of  scenarios  (cut  sets)  that  "lead  to"  the  undesired  top  event  of 
the  tree.  These  cut  sets  are  the  hazard  scenarios  that  must  be  evaluated. 

Each  basic  event  on  the  fault  tree  must  be  provided  a  probability  of 
occurrence  or  a  failure  frequency  (with  associated  downtime)  for  quantification 
of  the  tree.  Four  types  of  data  had  to  be  compiled  to  quantify  the  trees. 

1.  System  Scheduling  Data 

2.  Part  Reliabilities 

3.  Human  Error  Probabilities 

4.  Initiation  Probabilities 

Scheduling  information  was  largely  inferred  from  the  Batelle  Report 
(reference  2).  Part  reliability  data  has  been  compiled  at  IITRI  during  prior 
hazards  and  reliability  analyses  from  numerous  sources.  The  primary  source 
of  reliability  data  used,  however,  was  a  compilation  of  non-el ectronic  parts 
data  developed  by  the  Reliability  Analysis  Center,  an  IITRI  organization  in 
Rome,  New  York  (reference  1).  Human  error  data  has  been  compiled  under  a 
recent  project  conducted  by  IITRI  for  the  Chicago  Transit  Authority  (reference  6) 
and  that  was  the  primary  source  for  for  human  error  probabilities  used.  For 
initiation  probabilities,  the  primary  source  of  data  was  the  Hercules  Hazards 
Analyses  for  WADF  presented  in  the  Batelle  report  (reference  2).  The  most 
sensitive  material  for  which  data  was  available  was  used  for  each  stimulus 
type.  HBX-1  data  was  adopted  for  the  majority  of  cases  studied.  In  addition, 
there  were  numerous  cases  where  data  was  unavailable  and  subjective  judgements 
had  to  be  used.  For  example,  the  probability  that  a  significant  amount  of 
explosive  would  remain  is  a  vessel  during  maintenance  operations  or  that  a 
local  initiation  would  propagate  into  the  bulk  of  material  present  were  not 
easily  quantified.  Therefore,  subjective  judgements  had  to  be  used  to  esta¬ 
blish  probability  values  for  the  analysis. 
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The  criteria  for  safety  adequacy  is  stated  in  the  contract  as: 

"The  minimum  acceptable  level  of  risk  for  the  operation  and 
maintenance  for  the  entire  WADF  complex  and  any  subsystem  is  97,5 
percent  probability  with  a  95  percent  confidence  level  that  a 
category  1  or  2*  accident  will  not  happen  during  25  years  of 
operation  (40  hours  per  week)," 

This  translates  to  specifying  that  the  hazard  incident  probability  per 
year  for  the  entire  facility  is  less  than  or  equal  to  1/1000  with  a  95  percent 
confidence  level.  The  95  percent  confidence  level  criteria  will  be  evaluated 
for  the  facility  as  a  whole  using  the  dominant  cut  sets  derived  for  the 
different  plant  sections  as  the  basis.  Once  the  dominant  cut  sets  for  the 
facility  as  a  whole  have  been  identified  using  average  failure  frequencies 
and  error  probability  values,  Monte  Carlo  simulations  will  be  run  (on  these 
dominant  cut  sets)  to  develop  a  distribution  of  failure  frequencies  for 
the  WADF  as  a  whole.  The  distribution  created  for  the  VJADF  will  reflect 
uncertainties  involved  in  predicting  basic  event  frequency  or  probability 
values,  for  example  due  to  variations  in  equipment,  training  of  personnel, 
scheduling,  etc.  The  95  percent  confidence  level  will  then  be  determined  using 
the  derived  distribution.  These  "total  facility"  results  will  be  presented  in 
the  final  report.  For  the  mean  time,  a  probability  criteria  of  1/10,000 
will  be  used  as  a  cutoff  value  instead  of  "1/1,000  with  a  95  percent  confidence 
level"  in  order  to  interpret  the  fault  tree  analysis  results  for  each  plant 
area. 


*  Hazard  categories  are  defined  as  follows: 

Category  1  -  Catastrophic.  May  cause  death  or  system  loss.  System  loss 
shall  be  defined  as  damage  which  results  in  the  loss  of  25_percent  or  more 
production  capability  and  requires  30  days  or  more  to  repair. 

Category  2  -  Critical.  May  cause  severe  injury,  severe  occupational 
or  major  system  damage.  Major  system  damage  shall  be  defined  as  that  which 
results  in  more  than  10  percent  loss  of  production  capability  and  requires 
more  than  3  days  to  repair. 

Category  3  -  Marginal,  May  cause  minor  injury,  occupational  illness  or 
minor  system  damage.  Minor  system  damage  shall  be  defined  as  that  which 
resul  ts  in  10  percent  or  less  loss  of  production  capability  or  requires 
3  days  or  less  to  repair. 

Category  4  -  Negligible,  Will  not  result  in  injury,  occupational  illness 
or  system  damage. 
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ETHER  VAPOR  PROBLEM 
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The  amount  of  ether  left  in  the  propellant  cannot  be  specified  simply. 

The  amount  to  be  expected  within  the  vapor  space  of  a  closed  container  however 
is  related  to  its  recent  thermal  history.  Exposure  to  high  temperature  would 
drive  alcohol  and  ether  from  the  propellant  into  the  cartridge  case  atmosphere 
until  the  temperature-vapor  pressure  equilibrium  is  attained.  Cooling  would 
reverse  the  process, driving  the  vapors  back  into  the  propellant,  except  that  the 
rate  would  probably  be  orders  of  magnitude  slower. 

The  explosive  limits  of  diethyl  ether  and  ethyl  alcohol  are  given  below 
along  with  their  auto  ignition  temperatures. 

Explosive  Limits  (Vol .  %)  Auto  Ignition 

_ in  Air _  Temperature,  C 

Lower  Upper 

Ethanol  3.3  19  365 

Diethyl  Ether  1.9  36  160 

This  serves  to  point  out  that  ether-air  mixtures  are  more  hazardous  than 
alcohol -air  due  to  a  wider  range  of  flammable  mixtures  and  a  substantially 
lower  auto-ignition  temperature.  "In  general,  ethers  are  readily  ignited  by 
hot  surfaces.  These  combustibles  usually  have  a  lower  ignition  temperature 
in  air  and  in  oxygen  than  do  the  corresponding  paraffins  and  alcohols  ...  since 
ethers  tend  to  form  peroxides  under  a  variety  of  conditions,  they  may  appear 
to  be  unstable  at  room  temperature" (ref .  5). 

The  explosives  limit  of  an  ether  alcohol  vapor  mixture  would  lie  between 
the  limits  given  above.  The  exact  value  would  depend  on  the  mole  fraction  of 
each  component  in  the  vapor  space. 

The  concentration  of  solvent  vapors  in  the  void  spaces  in  a  cartridge 
case  prior  to  opening  the  case  has  been  evaluated  using  four  approaches  to 
help  to  better  understand  the  severity  of  this  hazard: 

1.  Since  ether  vapors  many  times  can  be  smelled  upon  opening 
packaged  propellant,  what  is  the  minimum  perceptible 
centration  of  the  ether  and  how  does  this  compare  to  the 
lower  flammable  limit  (LFL)? 

2.  If  the  solvent  remains  in  liquid  form  in  the  grains,  how 
does  its  vapor  pressure  compare  to  the  LFL? 

3.  If  all  the  residual  solvent  in  the  propellant  were  mixed 
with  air  in  the  void  space,  what  would  the  solvent  vapor 

concentration  be?||^  research  institute 


4.  If  the  solvent  is  in  solution  with  the  propellant  (i.e. 
not  like  a  separated  liquid)  and  if  the  solvent  partial 
pressure  is  proportional  to  its  mole  fraction,  what  would 
the  vapor  concentration  be? 

By  considering  the  minimum  perceptible  concentration  of  the  diethyl  ether 
(which  can  be  smelled)  it  is  found  that  a  concentration  of  0.7  ppm  is 
required  (ref.  7).  This  means  that  at  least  0.7  ppm  or  a  volume  percent 
of  7  X  10"^  is  present.  This  concentration  level  is  well  below  the  LFL  of 
1.9  percent  for  diethyl  ether, therefore,  the  vapor  may  or  may  not  be  flammable 
based  on  this  information. 

If  the  solvent  remains  in  the  liquid  form  in  the  propellant  (a  very  con¬ 
servative  point  of  view),  the  vapor  in  the  void  spaces  must  be  in  equilibrium 
with  the  liquid  vapor  pressure,  i.e,  at  40  mmHg  for  ethanol  and  400  mmHg  for 
diethylether .  Thus,  the  ethanol  concentration  would  at  worst  be  (40  mmHg/ 

760  mmHg)  X  100%  =  5.2%  and  similarly  the  ether  concentration  would  be  52 

percent,  both  well  above  the  LFL.  This  shows  that  it  is  possible  that  the 
vapor  could  be  concentrated  enough  to  pose  a  hazard. 

The  third  approach  addresses  whether  there  is  enough  solvent  in  the  pro¬ 
pellant  to  form  a  flammable  mixture  if  it  were  all  released  from  the  propellant 
into  the  void  spaces.  The  total  mass  of  solvent  m^  is  given  by 

nig  =  P  Y  tjjgV 


where  p  is  the  propellant  mass  density,  y  is  the  fraction  of  the  total  volume 
that  is  occupied  by  the  propellant  (packing  density),  (f)^  is  the  mass  fraction 
of  the  propellant  that  is  solvent  and  V  is  the  total  volume  of  the  cartridge 
case.  The  mass  of  the  gas  in  the  void 'spaces  between  grains  in  the  cartridge 
case  is  given  approximately  by: 


nig  paV  (1-y) 

where  pa  is  the  density  of  air.  In  this  case  it  is  assumed  that  the  gas  phase 
is  primarily  air,  which  is  expected  to  be  the  actual  situation.  Then,  the 
ratio  of  the  solvent  volume  to  the  gas  volume  is  given  by 

T' 

V-  Vm. 

■9  ■'  '"S' 
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in  which  M  represents  the  respective  molecular  weights  of  solvent  and  total 
gas  phase.  This  relation  is  derived  directly  from  perfect  gas  law  considera¬ 
tions. 

Typical  input  values  for  this  equation  are 


P 

PP 

y 

^s 

Mg 

TT 


0.0765  Ib/fr 
100  Ib/ft^ 
0.7 
0o03 

29 

47 


These  values  correspond  to  a  V  /V  of  56  indicating  that  there  is  enough 

s  g 

solvent  to  totally  fill  the  void  spaces  in  the  gas  phase.  The  same  result  is 
obtained  if  solvent  properties  replace  the  air  properties  in  the  equation. 


The  fourth  approach  is  to  scale  the  partial  pressure  of  the  solvent  based 
on  its  mole  fraction  in  the  mixture  with  the  propellant.  This  approach  is 
valid  for  a  mixture  of  liquids,  but  is  really  not  appropriate  for  mixtures 
with  solid  materials.  The  result,  however,  is  expected  to  be  representative 
of  what  will  happen  in  the  real  material.  This  approach  predicts  that  the 
ether  will  be  at  about  8.4%  and  the  alcohol  at  1.7%  by  volume. 


Other  calculations  could  also  be  made.  For  example,  the  reduction  in 
solvent  partial  pressure  can  be  estimated  by  considering  the  solubility  of  the 
propellant  in  the  solvent  mixture.  However,  each  approach  has  significant 
uncertainties.  For  this  reason,  it  is  strongly  recommended  that  gas  samples 
be  extracted  from  actual  cartridge  cases  to  determine  the  flammability  of  the 
mixture  with  certainty. 

From  the  available  information,  one  must  expect  the  vapor  composition  to 
be  principally  ether  at  room  temperature;  probably  above  the  upper  explosive 
limit  (36%  vol).  Once  the  cartridge  case  is  opened  and  the  ventilating  process 
takes  place,  the  concentration  must  pass  through  the  flammable  range,  i.e., 
from  36  to  1.9%.  It  is  during  this  time  that  the  greatest  hazard  is  present, 
i.e.,  from  thermal  ignition  due  to  the  low  auto  ignition  temperature  or  from 
ignition  by  spark.  It  should  be  noted  that  the  minimum  ignition  energy  for 
diethyl  ether  is  0.19  mj.  An  ungrounded  person  is  capable  of  discharging  on 
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the  order  of  15  to  22  mj.  While  good  engineering  practices  and  controls, 
principally  in  the  form  of  ventilation  can  act  to  minimize  the  risk,  it  must 
be  recognized  that  at  some  point  a  flammable,  easily  ignited  vapor  composition 
may  exist. 
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INITIATION  PROBABILITIES  FOR  PROPELLANTS 
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Initiation  Probabilities  for  Propellants 

Probit  initiation  curves  v/ere  not  available  for  the  propellant  materials 
to  be  processed  in  the  preparation  building  and  accumulator,  but  threshold 
initiation  level  (TIL)  data  was  available.  Typical  materials  to  be  processed  and 


their  TIL  values  for  impact,  friction, 
below  (ref. 4  ): 


Typical  Impact  « 

Propellants  (ft-lb/in  ) 


M6  (ground  20  mesh). 

Dry 

10.2 

MIMP  f/105  mm. 

Dry,  15  mils 
nominal  thickness 

6o6 

Fines  (88y  to  126y) 

8.0 

MIO  flake.  Dry,  14  mils 

6.6 

MIO  Granule,  Dry 

12.6 

mo  (T-36),  Dry 

1  5.0l 

Ml  7,  Dry 

8.0 

and  electrostatic  discharge  are  listed 
Threshold  Initiation  Level 


Friction 

Electrostatic  Discharge 

(psi  @  fps) 

(joules) 

52,500  @  8 

r^i 

57,200  @  8 

1.26 

66,000  @  8 

0.013 

30,800  0  8 

>5.0 

152,941  @  8 

^  5.0 

66,500  @  8 

>  5.0 

39,000  @  8 

>  5.0 

The  lowest  TIL  value  for  each  type  of  initiation  stimulus  is  highlighted.  Two 
values  are  shown  for  ESD,  both  of  which  are  for  propel  1  ant  fines  or  dust.  Pro¬ 
pellant  granules  are  much  less  sensitive  to  ESD  than  the  fines.  In  order  to 
conduct  a  quantitative  analysis,  probit  sensitivity  curves  were  constructed 
using  the  TIL  stimulus  level  at  the  0.05  probability  point  and  using  a  typical 
curve  slope  based  on  the  probit  curves  for  explosives  presented  in  reference  2. 
The  probit  curves  constructed  in  this  manner  are  given  in  figures  C-1  to  C-3. 
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PROBABILITY 


Person  ESD  Level 


Figure  C-3,  ESD  Probability  Curves 
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TRANSIENT  HEATING  OF  ITEMS  DUE  TO  FRICTION 
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Transient  Heating  of  Items  Due  to  Friction 

Several  scenarios  in  the  Preparation  Building,  Accumulator  Building, 
Mechanical  Removal  Building  and  Large  Cells  involved  situations  with  frictional 
heating  of  an  explosive  item  such  as  a  prajectile,  mortar  shell,  conveyor  roller 
bearings,  etc.  Two  simple  models  were  developed  to  calculate  transient  heating 
during  frictional  operations.  This  was  necessary  for  the  calculation  of  the 
probability  of  an  unwanted  frictional  operation  continuing  to  the  point  of 
thermal  initiation.  These  models  are  briefly  described  as  follows: 


Uniform  Temperature  Rise  Model 


This  first  model  is  used  for  those  cases  where  small  metal  items  are  heated, 
and  that  temperature  rise  is  assumed  uniform  throughout  the  item.  The  following 
expression  specifies  the  time  at  which  the  item  has  reached  a  critical  tempera¬ 
ture  capable  of  initiating  an  adjacent  explosive. 


mC_ 


t  =- 


hA 


In 


where 


'  -  ^  (Tc-T„) 


M  =  item  mass  (lb) 

Cp  =  item  specific  heat  (Btu/lb-°F) 

h  =  free  convection  heating  coefficient  (Btu/min-°F-ft  ) 

A  =  item  surface  area  (ft  ) 

Q  =  heat  input  of  item  due  to  friction  (See  Appendix 
dealing  with  friction)  (Btu/min) 

T^  =  critical  temperature  where  adjacent  explosive  may  initiate  (°F) 
Tq  =  ambient  temperature  (°F) 


Scenarios  analyzed  with  this  method  include  frictional  heating  of  mortar 
shell  fuzes  by  the  defuzing  chuck  (preparation  building  -  Cell  3)  and  frictional 
heating  of  medium  projectile  nose  fuzer  by  defuzing  chuck  (preparation  building  - 
Cell  6).  In  addition,  frictional  heating  of  the  lower  end  and  gravity  takeup 
rollers  of  the  smokeless  powder  conveyor  (for  stuck  roller  scenarios)  could  be 

evaluated  in  part  using  this  approach. 
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Fin  Temperature  Rise  Model 

Several  scenarios  demanded  a  model  for  which  one  can  calculate  temperature 
at  any  position  along  a  fin,  at  any  point  in  time,  where  a  constant  frictional 
heat  source  is  present  at  the  fin's  origin.  For  these  cases  the  following  ex¬ 
pression  was  derived. 


T  =  - 

X  0 


u  cosh  g  (L-X) 
a  sinh  at 


-vtj 


4=r 


+ 


xcosfe^ 


„  -K  n^TT^t 
e  7-2 - 


where 


t  = 

Tx  = 
To  = 

L  = 
X  = 
y 


time  (min) 

temperature  at  distance  X  along  fin  (F) 
initial  temperature  of  fin  (F) 
length  of  fin  (ft) 
distance  from  origin  along  fin  (ft) 


=  -q/h 


a 


V 


K  kA 


=  llP 
"  pCA 


_  k 

^  "  pC 


q  =  friction  heat  flux  per  unit  cross-sectional 
area  of  the  fin  (Btu/min-ft^) 
applied  at  X  =  0 

K  =  thermal  conductivity  of  the  fin  (Btu/min-ft-F) 

h  =  free  convective  heating  coefficient 
(Btu/min  -°F-ft^) 

p  =  fin  perimeter  (ft) 

A  =  cross-sectional  fin  area  (ft^) 

p  =  fin  density  (Ib/ft  ) 

c  =  fin  specific  heat  (Btu/lb-F) 


Scenarios  were  analyzed  with  this  expression  to  determine  if  a  critical 
initiation  temperature  can  be  reached,  and  if  so,  how  long  it  takes.  Some  of 
these  scenarios  studied  include: 

§  motor  shell  center  clamp  frictional  heating  (preparation 
building  -  Cell  3) 
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•  large  projectile  frictional  heating  against  vertical  defuzer 
clamp  (Large  Cell  C) 

•  conveyor  roller  bearing  overheating 

•  conveyor  stuck  roller  scenarios 
t  etc. 
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ELECTROSTATIC  DISCHARGE  ASSOCIATED  WITH  DIELECTRIC  SURFACES 
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Electrostatic  Discharge  Associated  With  Dielectric  Surfaces 

Dielectric  surfaces  may  store  considerable  charge,  but  because  of  their 
low  conductivity  only  a  small  portion  of  the  charge  will  drain  out  upon  dis¬ 
charge.  Therefore,  the  method  used  for  evaluating  dielectric  surfaces  empha¬ 
sizes  the  local  sparking  phenomenon  rather  than  the  total  stored  energy.  Con¬ 
sider  a  grounded  sphere  of  radius  R,  and  distance  H  above  a  charge  wall  (see 
Figure  Eli). 


The  capacitance  of  a  charged  sphere  above  a  grounded  wall  can  be  determined 
from  mirror  image  analysis  to  be 


C  =  2Tr£„R 
m 


2H-R 

H-R 


Since  the  capacitance  of  any  electrical  component  is  purely  a  function  of 
geometry,  this  capacitance  expression  applies  also  to  the  case  of  inverse 
charging,  with  which  we  are  concerned  (charged  wall  and  grounded  sphere).  Dis¬ 
charge  will  occur  when  the  sphere  is  close  enough  to  the  wall  to  produce  the 
breakdown  electric  field  in  sufficient  volume  between  the  sphere  and  the  wall. 
We  assume  that  this  occurs  when  the  sphere  is  height  H  above  the  wall.  At 
that  instant,  the  voltage  is  approximately 
V  =  EgH 

The  energy  released  in  the  spark  is  computed  from 


W  =  1  cv^ 
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Inserting  C  and  V  given  above  into  the  energy  equation  we  obtain: 


« =  « (w)  V  « 


2  ,.2 


For  this  energy  to  be  maximum  with  distance  from  the  wall  9W/3H  =  0.  Doing 
this  differentiation  a  quadratic  equation  results  with  the  following  solutions 
for  H. 


"-{j: 


39R 

36R 


The  second  value  is  impossible  since  the  sphere  would  have  to  have  penetrated 
the  wall  at  that  point.  This  leaves  H  =  1.39R  as  the  only  realistic  solution. 
Using  H  =  1.39R  in  the  expression  derived  for  energy  we  obtain 

“.ax  '  8.82ne,R3E,2 

In  analyses  of  dielectric  surfaces,  breakdown  was  assumed  to  occur  and  the 
energy  at  breakdown  was  computed  using  this  equation. 
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LIST  OF  SYMBOLS 


2 

A  =  item  surface  area  (ft  ) 

A  =  cross-sectional  fin  area  (ft  ) 

C  =  capacitance  (farads) 

c  =  fin  specific  heat  (Btu/lb-F) 

Cp  =  item  specific  heat  (Btu/lb-°F) 

Ed  =  breakdown  electric  field  strength  (volts/meter) 

D 

H  =  height  of  equivalent  grounded  sphere  above  wall  for  ESD  capacitance 
estimates  (meters)' 

2 

h  =  free  convection  heating  coefficient  (Btu/min-°F-ft  ) 

L  =  length  of  fin  (ft) 

M  =  item  mass  (lb) 

Mg  =  mass  of  the  gas  in  the  void  spaces  between  grains  in  the  cartridge  case 

M  =  respective  molecular  weights  of  solvent  and  total  gas  phase 

m  =  the  total  mass  of  solvent 

s 

p  =  fin  perimeter  (ft) 

Q  =  heat  input  of  item  due  to  friction  (Btu/min) 

q  =  friction  heat  flux  per  unit  cross-sectional  area  of  the  fin  (Btu/min-ft  ) 

applied  at  X  =  0 

R  =  radius  (meters) 

t  =  time  (min) 

T  =  temperature  at  distance  X  along  fin  (F) 

X 

=  initial  temperature  of  fin  or  ambient  temperature  (F) 

=  critical  temperature  where  adjacent  explosive  may  initiated  (°F) 

V  =  the  total  volume  of  the  cartridge  case 
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V  =  voltage  (volts) 

V  /V  =  ratio  of  the  solvent  volume  to  the  gas  volume 

s  9 

W  =  energy  (joules) 

X  =  distance  from  origin  along  fin  (ft) 

a  =  fraction  of  the  total  volume  that  is  occupied  by  the  propellant 
packing  density) 

e  =  permittivity  of  the  medium 

m 

$  =  mass  fraction  of  the  propellant  that  is  solvent 

s 

K  =  thermal  conductivity  of  the  fin  (Btu/min-ft-F) 
p  =  fin  density  (Ib/ft) 

p  =  propellant  mass  density 

=  density  of  air 
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